@de-otio/trellis 0.6.1 → 0.7.0

package/dist/lambda/post-confirmation.js

@@ -1,20 +1,64 @@
 "use strict";
+/**
+ * Cognito PostConfirmation trigger.
+ *
+ * Fires once per user-pool record after Cognito accepts a sign-up
+ * (`PostConfirmation_ConfirmSignUp`) or a forgotten-password confirmation
+ * (`PostConfirmation_ConfirmForgotPassword`). For federated identities the
+ * same trigger source is `PostConfirmation_ConfirmSignUp`; the
+ * `request.userAttributes.identities` JSON string is the disambiguator.
+ *
+ * Responsibilities (atomic, single Prisma transaction):
+ *  1. Upsert the `User` row (link `cognitoSub` to an existing email match,
+ *     otherwise create with a derived handle).
+ *  2. Ensure a personal `Tenant` of `type=PERSONAL` exists for the user,
+ *     plus a `TenantMember` with `role=OWNER`.
+ *  3. For federated users: exact-match the email domain against
+ *     `tenant_domains` (verified only). If the domain belongs to a tenant
+ *     with an `ACTIVE` IdP, resolve the user's role from `TenantRoleMapping`
+ *     (against the `custom:idpGroups` attribute) and create / refresh a
+ *     `TenantMember` row with `isJitProvisioned=true`.
+ *  4. Preserve the existing `ageTier` + parental-link logic from the v0.6
+ *     stub (B2C requirement).
+ *
+ * Idempotency: every write is an upsert. Cognito retries up to 3 times.
+ *
+ * Cross-tenant isolation: domain lookup is exact-match-only. No substring,
+ * no wildcard. See sec finding #8 in
+ * plans/mvp/10-trellis-stages/02-cognito-triggers.md.
+ *
+ * No PII (email body, group claim contents, raw IdP attributes) is logged.
+ */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.handler = void 0;
 const client_secrets_manager_1 = require("@aws-sdk/client-secrets-manager");
 const client_1 = require("@prisma/client");
+const claims_cache_1 = require("../lib/auth/claims-cache");
+const derive_domain_1 = require("../lib/tenant/derive-domain");
+const resolve_role_1 = require("../lib/tenant/resolve-role");
+const derive_handle_1 = require("../lib/user/derive-handle");
 const secretsClient = new client_secrets_manager_1.SecretsManagerClient({ region: process.env.AWS_REGION });
 let prisma = null;
+let cache = null;
 async function getPrisma() {
     if (prisma)
         return prisma;
     const secret = await secretsClient.send(new client_secrets_manager_1.GetSecretValueCommand({ SecretId: process.env.DB_SECRET_ARN }));
     const { username, password, host, port, dbname } = JSON.parse(secret.SecretString);
     prisma = new client_1.PrismaClient({
-        datasources: { db: { url: `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${dbname}?connection_limit=1` } },
+        datasources: {
+            db: {
+                url: `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${dbname}?connection_limit=1`,
+            },
+        },
     });
     return prisma;
 }
+function getCache() {
+    if (!cache)
+        cache = (0, claims_cache_1.createClaimsCacheFromEnv)();
+    return cache;
+}
 function computeAgeTier(dateOfBirth) {
     const now = new Date();
     let age = now.getUTCFullYear() - dateOfBirth.getUTCFullYear();
@@ -28,52 +72,312 @@ function computeAgeTier(dateOfBirth) {
         return "TEEN";
     return "ADULT";
 }
+function isFederatedEvent(event) {
+    const identitiesRaw = event.request.userAttributes["identities"];
+    if (!identitiesRaw)
+        return false;
+    try {
+        const parsed = JSON.parse(identitiesRaw);
+        return Array.isArray(parsed) && parsed.length > 0;
+    }
+    catch {
+        // Malformed `identities` is not a federation signal we can act on. Return
+        // false rather than over-classifying as federated, which would set
+        // role=B2B_PARTNER and run the org-tenant resolution path. (G2 M2)
+        return false;
+    }
+}
+function parseIdpGroups(raw) {
+    if (!raw)
+        return [];
+    // Split on `,` and `;` only — IdPs (notably Okta in displayName mode) may
+    // emit group names containing whitespace. Cognito's custom-attribute
+    // serialization is comma-separated; we accept semicolon as a defensive
+    // fallback. (G2 L1)
+    return raw
+        .split(/[,;]+/)
+        .map((s) => s.trim())
+        .filter(Boolean);
+}
+const SUPPORTED_TRIGGERS = new Set([
+    "PostConfirmation_ConfirmSignUp",
+    "PostConfirmation_ConfirmForgotPassword",
+]);
 const handler = async (event) => {
-    if (event.triggerSource !== "PostConfirmation_ConfirmSignUp")
+    if (!SUPPORTED_TRIGGERS.has(event.triggerSource))
         return event;
-    const { email, "custom:handle": handle, "custom:dateOfBirth": dateOfBirthStr } = event.request.userAttributes;
     const cognitoSub = event.userName;
-    const db = await getPrisma();
-    // Compute age tier from date of birth if provided
+    const attrs = event.request.userAttributes;
+    const email = attrs.email?.toLowerCase();
+    if (!email) {
+        console.warn(JSON.stringify({ event: "postconfirm.no_email", cognitoSub }));
+        return event;
+    }
+    const federated = isFederatedEvent(event);
+    const idpGroups = parseIdpGroups(attrs["custom:idpGroups"]);
+    const dobStr = attrs["custom:dateOfBirth"];
     let dateOfBirth;
     let ageTier = "ADULT";
-    if (dateOfBirthStr) {
-        dateOfBirth = new Date(dateOfBirthStr);
-        if (!isNaN(dateOfBirth.getTime()) && dateOfBirth < new Date()) {
-            ageTier = computeAgeTier(dateOfBirth);
-        }
-        else {
-            dateOfBirth = undefined;
+    if (dobStr) {
+        const parsed = new Date(dobStr);
+        if (!isNaN(parsed.getTime()) && parsed < new Date()) {
+            dateOfBirth = parsed;
+            ageTier = computeAgeTier(parsed);
         }
     }
-    const user = await db.user.upsert({
-        where: { cognitoSub },
-        create: {
-            cognitoSub,
-            email,
-            handle: handle || email.split("@")[0],
-            role: "END_USER",
-            ...(dateOfBirth && { dateOfBirth, ageTier }),
-        },
-        update: {
-            email,
-        },
-    });
-    // If child account, create a pending parental link if guardian email is provided
+    const db = await getPrisma();
+    const result = await db.$transaction(async (tx) => provisionUserAndTenancy(tx, {
+        cognitoSub,
+        email,
+        emailVerified: attrs.email_verified,
+        federated,
+        idpGroups,
+        dateOfBirth,
+        ageTier,
+        providedHandle: attrs["custom:handle"],
+    }), { timeout: 8000 });
     if (ageTier === "CHILD") {
-        const guardianEmail = event.request.userAttributes["custom:guardianEmail"];
+        const guardianEmail = attrs["custom:guardianEmail"]?.toLowerCase();
         if (guardianEmail) {
             const guardian = await db.user.findUnique({ where: { email: guardianEmail } });
             if (guardian) {
                 await db.parentalLink.upsert({
-                    where: { childId_guardianId: { childId: user.id, guardianId: guardian.id } },
-                    create: { childId: user.id, guardianId: guardian.id, status: "PENDING" },
+                    where: { childId_guardianId: { childId: result.userId, guardianId: guardian.id } },
+                    create: { childId: result.userId, guardianId: guardian.id, status: "PENDING" },
                     update: {},
                 });
             }
         }
     }
+    await primeClaimsCache(cognitoSub, result);
+    console.log(JSON.stringify({
+        event: "postconfirm.ok",
+        cognitoSub,
+        userId: result.userId,
+        personalTenantId: result.personalTenantId,
+        orgTenantId: result.orgTenantId,
+        federated,
+    }));
     return event;
 };
 exports.handler = handler;
+async function provisionUserAndTenancy(tx, input) {
+    const { cognitoSub, email, federated, idpGroups, dateOfBirth, ageTier, providedHandle, } = input;
+    const existing = await tx.user.findFirst({
+        where: { OR: [{ cognitoSub }, { email }] },
+    });
+    let user = existing;
+    if (!user) {
+        const initialHandle = (providedHandle && providedHandle.trim()) ||
+            (await (0, derive_handle_1.deriveHandle)(email, async (h) => {
+                const found = await tx.user.findFirst({ where: { handle: h }, select: { id: true } });
+                return !!found;
+            }));
+        user = await tx.user.create({
+            data: {
+                cognitoSub,
+                email,
+                handle: initialHandle,
+                role: federated ? "B2B_PARTNER" : "END_USER",
+                ...(dateOfBirth && { dateOfBirth, ageTier }),
+            },
+        });
+    }
+    else {
+        const updates = {};
+        if (!user.cognitoSub)
+            updates.cognitoSub = cognitoSub;
+        if (!user.handle) {
+            updates.handle = await (0, derive_handle_1.deriveHandle)(email, async (h) => {
+                const found = await tx.user.findFirst({
+                    where: { handle: h, NOT: { id: user.id } },
+                    select: { id: true },
+                });
+                return !!found;
+            });
+        }
+        if (Object.keys(updates).length > 0) {
+            user = await tx.user.update({ where: { id: user.id }, data: updates });
+        }
+    }
+    let personalTenantId = user.personalTenantId;
+    let personalTenantSlug = "";
+    if (!personalTenantId) {
+        const personalSlug = `personal-${user.id}`;
+        const personalTenant = await tx.tenant.create({
+            data: {
+                slug: personalSlug,
+                displayName: user.handle ?? "personal",
+                type: "PERSONAL",
+                personalOwnerUserId: user.id,
+            },
+        });
+        personalTenantId = personalTenant.id;
+        personalTenantSlug = personalTenant.slug;
+        await tx.tenantMember.upsert({
+            where: { tenantId_userId: { tenantId: personalTenant.id, userId: user.id } },
+            create: {
+                tenantId: personalTenant.id,
+                userId: user.id,
+                role: "OWNER",
+                status: "ACTIVE",
+                joinedAt: new Date(),
+            },
+            update: { status: "ACTIVE" },
+        });
+        await tx.user.update({
+            where: { id: user.id },
+            data: { personalTenantId: personalTenant.id },
+        });
+    }
+    else {
+        const personal = await tx.tenant.findUnique({
+            where: { id: personalTenantId },
+            select: { slug: true },
+        });
+        personalTenantSlug = personal?.slug ?? "";
+        await tx.tenantMember.upsert({
+            where: { tenantId_userId: { tenantId: personalTenantId, userId: user.id } },
+            create: {
+                tenantId: personalTenantId,
+                userId: user.id,
+                role: "OWNER",
+                status: "ACTIVE",
+                joinedAt: new Date(),
+            },
+            update: {},
+        });
+    }
+    let orgTenantId = null;
+    let orgTenantSlug = null;
+    let orgTenantRole = null;
+    if (federated) {
+        // Defensive: only resolve org-tenant membership when Cognito asserts the
+        // email is verified by the IdP. Native Cognito sign-ups always reach this
+        // trigger with email_verified=true; for federated identities the value
+        // depends on the IdP's attribute mapping. Without this check, an IdP
+        // misconfigured to skip verification would let a user claim any
+        // domain-bound tenant by self-asserting an email. Personal-tenant
+        // creation above is unaffected — Cognito has already authenticated them.
+        const emailVerified = input.emailVerified === "true";
+        if (!emailVerified) {
+            console.warn(JSON.stringify({ event: "postconfirm.federated.email_unverified", cognitoSub }));
+            return {
+                userId: user.id,
+                globalRole: user.role,
+                handle: user.handle ?? "",
+                personalTenantId: personalTenantId,
+                personalTenantSlug,
+                orgTenantId: null,
+                orgTenantSlug: null,
+                orgTenantRole: null,
+            };
+        }
+        const domain = (0, derive_domain_1.deriveEmailDomain)(email);
+        if (!domain) {
+            console.warn(JSON.stringify({ event: "postconfirm.federated.invalid_email", cognitoSub }));
+        }
+        else {
+            const tenantDomain = await tx.tenantDomain.findUnique({
+                where: { domain },
+                include: {
+                    tenant: {
+                        include: {
+                            identityProvider: {
+                                select: { status: true, defaultRole: true },
+                            },
+                            roleMappings: {
+                                select: { idpGroupName: true, tenantRole: true, priority: true },
+                            },
+                        },
+                    },
+                },
+            });
+            if (!tenantDomain) {
+                console.warn(JSON.stringify({ event: "postconfirm.federated.no_domain_match", cognitoSub }));
+            }
+            else if (!tenantDomain.verifiedAt) {
+                console.warn(JSON.stringify({
+                    event: "postconfirm.federated.unverified_domain",
+                    cognitoSub,
+                    tenantId: tenantDomain.tenantId,
+                }));
+            }
+            else if (!tenantDomain.tenant.identityProvider ||
+                tenantDomain.tenant.identityProvider.status !== "ACTIVE") {
+                console.warn(JSON.stringify({
+                    event: "postconfirm.federated.inactive_idp",
+                    cognitoSub,
+                    tenantId: tenantDomain.tenantId,
+                }));
+            }
+            else {
+                const role = (0, resolve_role_1.resolveTenantRole)(idpGroups, tenantDomain.tenant.roleMappings, tenantDomain.tenant.identityProvider.defaultRole);
+                if (!role) {
+                    console.warn(JSON.stringify({
+                        event: "postconfirm.federated.no_role",
+                        cognitoSub,
+                        tenantId: tenantDomain.tenantId,
+                    }));
+                }
+                else {
+                    await tx.tenantMember.upsert({
+                        where: {
+                            tenantId_userId: { tenantId: tenantDomain.tenantId, userId: user.id },
+                        },
+                        create: {
+                            tenantId: tenantDomain.tenantId,
+                            userId: user.id,
+                            role,
+                            status: "ACTIVE",
+                            joinedAt: new Date(),
+                            isJitProvisioned: true,
+                        },
+                        update: {
+                            role,
+                            status: "ACTIVE",
+                            lastActiveAt: new Date(),
+                        },
+                    });
+                    orgTenantId = tenantDomain.tenantId;
+                    orgTenantSlug = tenantDomain.tenant.slug;
+                    orgTenantRole = role;
+                }
+            }
+        }
+    }
+    return {
+        userId: user.id,
+        globalRole: user.role,
+        handle: user.handle ?? "",
+        personalTenantId: personalTenantId,
+        personalTenantSlug,
+        orgTenantId,
+        orgTenantSlug,
+        orgTenantRole,
+    };
+}
+async function primeClaimsCache(cognitoSub, result) {
+    const activeTenantId = result.orgTenantId ?? result.personalTenantId;
+    const activeTenantSlug = result.orgTenantSlug ?? result.personalTenantSlug;
+    const activeTenantRole = result.orgTenantRole ?? "OWNER";
+    const claims = {
+        userId: result.userId,
+        globalRole: result.globalRole,
+        activeTenantId,
+        tenantSlug: activeTenantSlug,
+        tenantRole: activeTenantRole,
+        handle: result.handle,
+    };
+    try {
+        await getCache().put(cognitoSub, claims);
+    }
+    catch (err) {
+        console.warn(JSON.stringify({
+            event: "postconfirm.cache_prime_failed",
+            cognitoSub,
+            error: err.code ?? "unknown",
+        }));
+    }
+}
 //# sourceMappingURL=post-confirmation.js.map

package/dist/lambda/post-confirmation.js.map

@@ -1 +1 @@
-{"version":3,"file":"post-confirmation.js","sourceRoot":"","sources":["../../src/lambda/post-confirmation.ts"],"names":[],"mappings":";;;AACA,4EAA8F;AAC9F,2CAA4D;AAE5D,MAAM,aAAa,GAAG,IAAI,6CAAoB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AACnF,IAAI,MAAM,GAAwB,IAAI,CAAC;AAEvC,KAAK,UAAU,SAAS;IACtB,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,8CAAqB,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,aAAc,EAAE,CAAC,CAAC,CAAC;IAC7G,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAa,CAAC,CAAC;IACpF,MAAM,GAAG,IAAI,qBAAY,CAAC;QACxB,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,gBAAgB,QAAQ,IAAI,kBAAkB,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,MAAM,qBAAqB,EAAE,EAAE;KACtI,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,WAAiB;IACvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,IAAI,GAAG,GAAG,GAAG,CAAC,cAAc,EAAE,GAAG,WAAW,CAAC,cAAc,EAAE,CAAC;IAC9D,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,EAAE,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IAChE,IAAI,SAAS,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,GAAG,WAAW,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC;QACtF,GAAG,EAAE,CAAC;IACR,CAAC;IACD,IAAI,GAAG,GAAG,EAAE;QAAE,OAAO,OAAO,CAAC;IAC7B,IAAI,GAAG,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC;IAC5B,OAAO,OAAO,CAAC;AACjB,CAAC;AAEM,MAAM,OAAO,GAAmC,KAAK,EAAE,KAAK,EAAE,EAAE;IACrE,IAAI,KAAK,CAAC,aAAa,KAAK,gCAAgC;QAAE,OAAO,KAAK,CAAC;IAE3E,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,oBAAoB,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;IAC9G,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC;IAElC,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;IAE7B,kDAAkD;IAClD,IAAI,WAA6B,CAAC;IAClC,IAAI,OAAO,GAAY,OAAO,CAAC;IAC/B,IAAI,cAAc,EAAE,CAAC;QACnB,WAAW,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,IAAI,WAAW,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAC9D,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,SAAS,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;QAChC,KAAK,EAAE,EAAE,UAAU,EAAE;QACrB,MAAM,EAAE;YACN,UAAU;YACV,KAAK;YACL,MAAM,EAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,EAAE,UAAU;YAChB,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;SAC7C;QACD,MAAM,EAAE;YACN,KAAK;SACN;KACF,CAAC,CAAC;IAEH,iFAAiF;IACjF,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;QAC3E,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;YAC/E,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;oBAC3B,KAAK,EAAE,EAAE,kBAAkB,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE;oBAC5E,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;oBACxE,MAAM,EAAE,EAAE;iBACX,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAlDW,QAAA,OAAO,WAkDlB"}
+{"version":3,"file":"post-confirmation.js","sourceRoot":"","sources":["../../src/lambda/post-confirmation.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;;;AAMH,4EAA8F;AAC9F,2CAMwB;AACxB,2DAAoG;AACpG,+DAAgE;AAChE,6DAAsF;AACtF,6DAAyD;AAEzD,MAAM,aAAa,GAAG,IAAI,6CAAoB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AACnF,IAAI,MAAM,GAAwB,IAAI,CAAC;AACvC,IAAI,KAAK,GAAuB,IAAI,CAAC;AAErC,KAAK,UAAU,SAAS;IACtB,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CACrC,IAAI,8CAAqB,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,aAAc,EAAE,CAAC,CACpE,CAAC;IACF,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAa,CAAC,CAAC;IACpF,MAAM,GAAG,IAAI,qBAAY,CAAC;QACxB,WAAW,EAAE;YACX,EAAE,EAAE;gBACF,GAAG,EAAE,gBAAgB,QAAQ,IAAI,kBAAkB,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,MAAM,qBAAqB;aAC7G;SACF;KACF,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ;IACf,IAAI,CAAC,KAAK;QAAE,KAAK,GAAG,IAAA,uCAAwB,GAAE,CAAC;IAC/C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,WAAiB;IACvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,IAAI,GAAG,GAAG,GAAG,CAAC,cAAc,EAAE,GAAG,WAAW,CAAC,cAAc,EAAE,CAAC;IAC9D,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,EAAE,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IAChE,IAAI,SAAS,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,GAAG,WAAW,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC;QACtF,GAAG,EAAE,CAAC;IACR,CAAC;IACD,IAAI,GAAG,GAAG,EAAE;QAAE,OAAO,OAAO,CAAC;IAC7B,IAAI,GAAG,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC;IAC5B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAmC;IAC3D,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IACjE,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACzC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,mEAAmE;QACnE,mEAAmE;QACnE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAA8B;IACpD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,0EAA0E;IAC1E,qEAAqE;IACrE,uEAAuE;IACvE,oBAAoB;IACpB,OAAO,GAAG;SACP,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAaD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,gCAAgC;IAChC,wCAAwC;CACzC,CAAC,CAAC;AAEI,MAAM,OAAO,GAAmC,KAAK,EAAE,KAAK,EAAE,EAAE;IACrE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IAE/D,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAE3C,IAAI,WAA6B,CAAC;IAClC,IAAI,OAAO,GAAY,OAAO,CAAC;IAC/B,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,MAAM,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YACpD,WAAW,GAAG,MAAM,CAAC;YACrB,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;IAE7B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,YAAY,CAClC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,uBAAuB,CAAC,EAAE,EAAE;QACxC,UAAU;QACV,KAAK;QACL,aAAa,EAAE,KAAK,CAAC,cAAc;QACnC,SAAS;QACT,SAAS;QACT,WAAW;QACX,OAAO;QACP,cAAc,EAAE,KAAK,CAAC,eAAe,CAAC;KACvC,CAAC,EACF,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;IAEF,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,MAAM,aAAa,GAAG,KAAK,CAAC,sBAAsB,CAAC,EAAE,WAAW,EAAE,CAAC;QACnE,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;YAC/E,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;oBAC3B,KAAK,EAAE,EAAE,kBAAkB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE;oBAClF,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;oBAC9E,MAAM,EAAE,EAAE;iBACX,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAE3C,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE,gBAAgB;QACvB,UAAU;QACV,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS;KACV,CAAC,CACH,CAAC;IAEF,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AArEW,QAAA,OAAO,WAqElB;AAaF,KAAK,UAAU,uBAAuB,CACpC,EAA4B,EAC5B,KAAwB;IAExB,MAAM,EACJ,UAAU,EACV,KAAK,EACL,SAAS,EACT,SAAS,EACT,WAAW,EACX,OAAO,EACP,cAAc,GACf,GAAG,KAAK,CAAC;IAEV,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;QACvC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;KAC3C,CAAC,CAAC;IAEH,IAAI,IAAI,GAAG,QAAQ,CAAC;IACpB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,aAAa,GACjB,CAAC,cAAc,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC;YACzC,CAAC,MAAM,IAAA,4BAAY,EAAC,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACrC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;gBACtF,OAAO,CAAC,CAAC,KAAK,CAAC;YACjB,CAAC,CAAC,CAAC,CAAC;QACN,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;YAC1B,IAAI,EAAE;gBACJ,UAAU;gBACV,KAAK;gBACL,MAAM,EAAE,aAAa;gBACrB,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU;gBAC5C,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;aAC7C;SACF,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;QACtD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,GAAG,MAAM,IAAA,4BAAY,EAAC,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACrD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;oBACpC,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAK,CAAC,EAAE,EAAE,EAAE;oBAC3C,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;iBACrB,CAAC,CAAC;gBACH,OAAO,CAAC,CAAC,KAAK,CAAC;YACjB,CAAC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAC7C,IAAI,kBAAkB,GAAG,EAAE,CAAC;IAC5B,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,YAAY,GAAG,YAAY,IAAI,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;YAC5C,IAAI,EAAE;gBACJ,IAAI,EAAE,YAAY;gBAClB,WAAW,EAAE,IAAI,CAAC,MAAM,IAAI,UAAU;gBACtC,IAAI,EAAE,UAAU;gBAChB,mBAAmB,EAAE,IAAI,CAAC,EAAE;aAC7B;SACF,CAAC,CAAC;QACH,gBAAgB,GAAG,cAAc,CAAC,EAAE,CAAC;QACrC,kBAAkB,GAAG,cAAc,CAAC,IAAI,CAAC;QACzC,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;YAC3B,KAAK,EAAE,EAAE,eAAe,EAAE,EAAE,QAAQ,EAAE,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE;YAC5E,MAAM,EAAE;gBACN,QAAQ,EAAE,cAAc,CAAC,EAAE;gBAC3B,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,QAAQ;gBAChB,QAAQ,EAAE,IAAI,IAAI,EAAE;aACrB;YACD,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;SAC7B,CAAC,CAAC;QACH,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;YACnB,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;YACtB,IAAI,EAAE,EAAE,gBAAgB,EAAE,cAAc,CAAC,EAAE,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;YAC1C,KAAK,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE;YAC/B,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;SACvB,CAAC,CAAC;QACH,kBAAkB,GAAG,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;QAC1C,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;YAC3B,KAAK,EAAE,EAAE,eAAe,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE;YAC3E,MAAM,EAAE;gBACN,QAAQ,EAAE,gBAAgB;gBAC1B,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,QAAQ;gBAChB,QAAQ,EAAE,IAAI,IAAI,EAAE;aACrB;YACD,MAAM,EAAE,EAAE;SACX,CAAC,CAAC;IACL,CAAC;IAED,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,IAAI,aAAa,GAAsB,IAAI,CAAC;IAC5C,IAAI,SAAS,EAAE,CAAC;QACd,yEAAyE;QACzE,0EAA0E;QAC1E,uEAAuE;QACvE,qEAAqE;QACrE,gEAAgE;QAChE,kEAAkE;QAClE,yEAAyE;QACzE,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC;QACrD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CACV,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,UAAU,EAAE,CAAC,CAChF,CAAC;YACF,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,UAAU,EAAE,IAAI,CAAC,IAAI;gBACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;gBACzB,gBAAgB,EAAE,gBAAiB;gBACnC,kBAAkB;gBAClB,WAAW,EAAE,IAAI;gBACjB,aAAa,EAAE,IAAI;gBACnB,aAAa,EAAE,IAAI;aACpB,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,iCAAiB,EAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;QAC7F,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC;gBACpD,KAAK,EAAE,EAAE,MAAM,EAAE;gBACjB,OAAO,EAAE;oBACP,MAAM,EAAE;wBACN,OAAO,EAAE;4BACP,gBAAgB,EAAE;gCAChB,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;6BAC5C;4BACD,YAAY,EAAE;gCACZ,MAAM,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;6BACjE;yBACF;qBACF;iBACF;aACF,CAAC,CAAC;YAEH,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO,CAAC,IAAI,CACV,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,UAAU,EAAE,CAAC,CAC/E,CAAC;YACJ,CAAC;iBAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC;gBACpC,OAAO,CAAC,IAAI,CACV,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,yCAAyC;oBAChD,UAAU;oBACV,QAAQ,EAAE,YAAY,CAAC,QAAQ;iBAChC,CAAC,CACH,CAAC;YACJ,CAAC;iBAAM,IACL,CAAC,YAAY,CAAC,MAAM,CAAC,gBAAgB;gBACrC,YAAY,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAK,QAAQ,EACxD,CAAC;gBACD,OAAO,CAAC,IAAI,CACV,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,oCAAoC;oBAC3C,UAAU;oBACV,QAAQ,EAAE,YAAY,CAAC,QAAQ;iBAChC,CAAC,CACH,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,IAAA,gCAAiB,EAC5B,SAAS,EACT,YAAY,CAAC,MAAM,CAAC,YAAkC,EACtD,YAAY,CAAC,MAAM,CAAC,gBAAgB,CAAC,WAAW,CACjD,CAAC;gBACF,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,OAAO,CAAC,IAAI,CACV,IAAI,CAAC,SAAS,CAAC;wBACb,KAAK,EAAE,+BAA+B;wBACtC,UAAU;wBACV,QAAQ,EAAE,YAAY,CAAC,QAAQ;qBAChC,CAAC,CACH,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;wBAC3B,KAAK,EAAE;4BACL,eAAe,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;yBACtE;wBACD,MAAM,EAAE;4BACN,QAAQ,EAAE,YAAY,CAAC,QAAQ;4BAC/B,MAAM,EAAE,IAAI,CAAC,EAAE;4BACf,IAAI;4BACJ,MAAM,EAAE,QAAQ;4BAChB,QAAQ,EAAE,IAAI,IAAI,EAAE;4BACpB,gBAAgB,EAAE,IAAI;yBACvB;wBACD,MAAM,EAAE;4BACN,IAAI;4BACJ,MAAM,EAAE,QAAQ;4BAChB,YAAY,EAAE,IAAI,IAAI,EAAE;yBACzB;qBACF,CAAC,CAAC;oBACH,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC;oBACpC,aAAa,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC;oBACzC,aAAa,GAAG,IAAI,CAAC;gBACvB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,UAAU,EAAE,IAAI,CAAC,IAAI;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;QACzB,gBAAgB,EAAE,gBAAiB;QACnC,kBAAkB;QAClB,WAAW;QACX,aAAa;QACb,aAAa;KACd,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,UAAkB,EAAE,MAA0B;IAC5E,MAAM,cAAc,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,gBAAgB,CAAC;IACrE,MAAM,gBAAgB,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,kBAAkB,CAAC;IAC3E,MAAM,gBAAgB,GAAG,MAAM,CAAC,aAAa,IAAI,OAAO,CAAC;IACzD,MAAM,MAAM,GAAiB;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,cAAc;QACd,UAAU,EAAE,gBAAgB;QAC5B,UAAU,EAAE,gBAAgB;QAC5B,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC;IACF,IAAI,CAAC;QACH,MAAM,QAAQ,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,gCAAgC;YACvC,UAAU;YACV,KAAK,EAAG,GAAyB,CAAC,IAAI,IAAI,SAAS;SACpD,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/lambda/pre-token-generation.d.ts

@@ -1,3 +1,23 @@
+/**
+ * Cognito PreTokenGeneration trigger (V2 access-token override).
+ *
+ * Runs on every token issuance and refresh. Responsibilities:
+ *  1. Read the cached claims from DynamoDB.
+ *  2. On miss: load from RDS (User + active TenantMember + Tenant slug).
+ *  3. For federated users: re-resolve the tenant role from the current
+ *     `custom:idpGroups` against `TenantRoleMapping`. This catches admin-side
+ *     group changes within the access-token TTL.
+ *  4. Write the (possibly refreshed) claims back to DDB.
+ *  5. Override the access-token claims via the V2 response shape.
+ *
+ * Failure modes:
+ *  - User row missing (drift after RDS restore): return minimal claims —
+ *    the API responds 403 to tenant-scoped endpoints, never a 500 at sign-in.
+ *  - DDB or RDS error: bubble up; Cognito treats the issuance as failed.
+ *
+ * No PII is logged. We log counts and decisions ("cache_hit", "drift",
+ * "role_refreshed") and the opaque cognitoSub.
+ */
 import type { PreTokenGenerationV2TriggerHandler } from "aws-lambda";
 export declare const handler: PreTokenGenerationV2TriggerHandler;
 //# sourceMappingURL=pre-token-generation.d.ts.map

package/dist/lambda/pre-token-generation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pre-token-generation.d.ts","sourceRoot":"","sources":["../../src/lambda/pre-token-generation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAoC,kCAAkC,EAAE,MAAM,YAAY,CAAC;AA0EvG,eAAO,MAAM,OAAO,EAAE,kCAkBrB,CAAC"}
+{"version":3,"file":"pre-token-generation.d.ts","sourceRoot":"","sources":["../../src/lambda/pre-token-generation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAEV,kCAAkC,EACnC,MAAM,YAAY,CAAC;AAwKpB,eAAO,MAAM,OAAO,EAAE,kCAyHrB,CAAC"}