@fnd-platform/cognito-auth 1.0.0-alpha.1 → 1.0.0-alpha.10

package/lib/types.d.ts

@@ -7,155 +7,189 @@
  * Cognito JWT payload structure from access token.
  */
 export interface CognitoAccessTokenPayload {
-  /** User's unique identifier */
-  sub: string;
-  /** Cognito groups the user belongs to */
-  'cognito:groups'?: string[];
-  /** Token use type */
-  token_use: 'access';
-  /** Token scopes */
-  scope?: string;
-  /** Issuer URL */
-  iss: string;
-  /** Expiration timestamp */
-  exp: number;
-  /** Issued at timestamp */
-  iat: number;
-  /** Client ID */
-  client_id: string;
-  /** Username */
-  username: string;
+    /** User's unique identifier */
+    sub: string;
+    /** Cognito groups the user belongs to */
+    'cognito:groups'?: string[];
+    /** Token use type */
+    token_use: 'access';
+    /** Token scopes */
+    scope?: string;
+    /** Issuer URL */
+    iss: string;
+    /** Expiration timestamp */
+    exp: number;
+    /** Issued at timestamp */
+    iat: number;
+    /** Client ID */
+    client_id: string;
+    /** Username */
+    username: string;
 }
 /**
  * Cognito JWT payload structure from ID token.
  */
 export interface CognitoIdTokenPayload {
-  /** User's unique identifier */
-  sub: string;
-  /** User's email address */
-  email?: string;
-  /** Whether email is verified */
-  email_verified?: boolean;
-  /** Cognito groups the user belongs to */
-  'cognito:groups'?: string[];
-  /** Cognito username */
-  'cognito:username'?: string;
-  /** Token use type */
-  token_use: 'id';
-  /** Issuer URL */
-  iss: string;
-  /** Expiration timestamp */
-  exp: number;
-  /** Issued at timestamp */
-  iat: number;
-  /** Audience (client ID) */
-  aud: string;
+    /** User's unique identifier */
+    sub: string;
+    /** User's email address */
+    email?: string;
+    /** Whether email is verified */
+    email_verified?: boolean;
+    /** Cognito groups the user belongs to */
+    'cognito:groups'?: string[];
+    /** Cognito username */
+    'cognito:username'?: string;
+    /** Token use type */
+    token_use: 'id';
+    /** Issuer URL */
+    iss: string;
+    /** Expiration timestamp */
+    exp: number;
+    /** Issued at timestamp */
+    iat: number;
+    /** Audience (client ID) */
+    aud: string;
 }
 /**
  * Configuration for JWT verification.
  */
 export interface JwtVerifierConfig {
-  /** Cognito User Pool ID */
-  userPoolId: string;
-  /** Cognito Client ID */
-  clientId: string;
-  /** Token type to verify */
-  tokenUse?: 'access' | 'id';
+    /** Cognito User Pool ID */
+    userPoolId: string;
+    /** Cognito Client ID */
+    clientId: string;
+    /** Token type to verify */
+    tokenUse?: 'access' | 'id';
 }
 /**
  * Configuration options for the auth middleware.
  */
 export interface CognitoAuthOptions {
-  /** Cognito User Pool ID (defaults to COGNITO_USER_POOL_ID env var) */
-  userPoolId?: string;
-  /** Cognito Client ID (defaults to COGNITO_CLIENT_ID env var) */
-  clientId?: string;
-  /** Required roles (Cognito groups). User must have at least one. */
-  roles?: string[];
-  /** Paths to skip authentication for */
-  skipPaths?: string[];
-  /** Token type to verify */
-  tokenUse?: 'access' | 'id';
+    /** Cognito User Pool ID (defaults to COGNITO_USER_POOL_ID env var) */
+    userPoolId?: string;
+    /** Cognito Client ID (defaults to COGNITO_CLIENT_ID env var) */
+    clientId?: string;
+    /** Required roles (Cognito groups). User must have at least one. */
+    roles?: string[];
+    /** Paths to skip authentication for */
+    skipPaths?: string[];
+    /** Token type to verify */
+    tokenUse?: 'access' | 'id';
 }
 /**
  * Result of successful token verification.
  */
 export interface TokenVerificationResult {
-  /** User ID (sub claim) */
-  userId: string;
-  /** User email (from ID token or access token if present) */
-  email?: string;
-  /** User's Cognito groups */
-  groups: string[];
-  /** Raw token payload */
-  payload: CognitoAccessTokenPayload | CognitoIdTokenPayload;
+    /** User ID (sub claim) */
+    userId: string;
+    /** User email (from ID token or access token if present) */
+    email?: string;
+    /** User's Cognito groups */
+    groups: string[];
+    /** Raw token payload */
+    payload: CognitoAccessTokenPayload | CognitoIdTokenPayload;
 }
 /**
  * Configuration for FndAuthClient.
  */
 export interface AuthClientConfig {
-  /** Cognito User Pool ID */
-  userPoolId: string;
-  /** Cognito Client ID */
-  clientId: string;
-  /** AWS region (defaults to AWS_REGION env var) */
-  region?: string;
+    /** Cognito User Pool ID */
+    userPoolId: string;
+    /** Cognito Client ID */
+    clientId: string;
+    /** AWS region (defaults to AWS_REGION env var) */
+    region?: string;
 }
 /**
  * Authentication tokens returned from Cognito.
  */
 export interface AuthTokens {
-  /** JWT access token */
-  accessToken: string;
-  /** JWT ID token */
-  idToken: string;
-  /** Refresh token for obtaining new tokens */
-  refreshToken: string;
-  /** Token expiration in seconds */
-  expiresIn: number;
+    /** JWT access token */
+    accessToken: string;
+    /** JWT ID token */
+    idToken: string;
+    /** Refresh token for obtaining new tokens */
+    refreshToken: string;
+    /** Token expiration in seconds */
+    expiresIn: number;
 }
 /**
  * Result of sign-up operation.
  */
 export interface SignUpResult {
-  /** Whether user confirmation is required */
-  userConfirmed: boolean;
-  /** Delivery details for confirmation code (if applicable) */
-  codeDeliveryDetails?: {
-    /** Destination (masked email/phone) */
-    destination?: string;
-    /** Delivery medium */
-    deliveryMedium?: 'EMAIL' | 'SMS';
-  };
+    /** Whether user confirmation is required */
+    userConfirmed: boolean;
+    /** Delivery details for confirmation code (if applicable) */
+    codeDeliveryDetails?: {
+        /** Destination (masked email/phone) */
+        destination?: string;
+        /** Delivery medium */
+        deliveryMedium?: 'EMAIL' | 'SMS';
+    };
+}
+/**
+ * Challenge types that may be returned during sign-in.
+ */
+export type AuthChallenge = 'NEW_PASSWORD_REQUIRED' | 'SMS_MFA' | 'SOFTWARE_TOKEN_MFA';
+/**
+ * Result of sign-in operation.
+ *
+ * May return either tokens (successful auth) or a challenge (requires additional action).
+ */
+export type SignInResult = {
+    success: true;
+    tokens: AuthTokens;
+} | {
+    success: false;
+    challenge: AuthChallenge;
+    session: string;
+    email: string;
+};
+/**
+ * Result of forgot password initiation.
+ */
+export interface ForgotPasswordResult {
+    /** Delivery details for reset code */
+    codeDeliveryDetails?: {
+        /** Destination (masked email/phone) */
+        destination?: string;
+        /** Delivery medium */
+        deliveryMedium?: 'EMAIL' | 'SMS';
+    };
 }
 /**
  * Session data stored in cookies.
+ *
+ * Note: accessToken and idToken are optional because they are not stored
+ * in the cookie session to stay under browser cookie size limits (~4KB).
+ * Use the refreshToken to obtain fresh tokens when needed for API calls.
  */
 export interface SessionData {
-  /** JWT access token */
-  accessToken: string;
-  /** JWT ID token */
-  idToken: string;
-  /** Refresh token */
-  refreshToken: string;
-  /** Expiration timestamp (ms since epoch) */
-  expiresAt: number;
-  /** User ID (sub claim) */
-  userId: string;
-  /** User email */
-  email: string;
-  /** User's Cognito groups */
-  groups: string[];
+    /** JWT access token (not stored in session, use refreshToken to obtain) */
+    accessToken?: string;
+    /** JWT ID token (not stored in session, use refreshToken to obtain) */
+    idToken?: string;
+    /** Refresh token */
+    refreshToken: string;
+    /** Expiration timestamp (ms since epoch) */
+    expiresAt: number;
+    /** User ID (sub claim) */
+    userId: string;
+    /** User email */
+    email: string;
+    /** User's Cognito groups */
+    groups: string[];
 }
 /**
  * User information extracted from session.
  */
 export interface SessionUser {
-  /** User ID */
-  userId: string;
-  /** User email */
-  email: string;
-  /** User's groups/roles */
-  groups: string[];
+    /** User ID */
+    userId: string;
+    /** User email */
+    email: string;
+    /** User's groups/roles */
+    groups: string[];
 }
-//# sourceMappingURL=types.d.ts.map
+//# sourceMappingURL=types.d.ts.map

package/lib/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,+BAA+B;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,qBAAqB;IACrB,SAAS,EAAE,QAAQ,CAAC;IACpB,mBAAmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iBAAiB;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,gBAAgB;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,+BAA+B;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,yCAAyC;IACzC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,uBAAuB;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB;IACrB,SAAS,EAAE,IAAI,CAAC;IAChB,iBAAiB;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,wBAAwB;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,2BAA2B;IAC3B,QAAQ,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,2BAA2B;IAC3B,QAAQ,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4BAA4B;IAC5B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,wBAAwB;IACxB,OAAO,EAAE,yBAAyB,GAAG,qBAAqB,CAAC;CAC5D;AAID;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,wBAAwB;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,uBAAuB;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,4CAA4C;IAC5C,aAAa,EAAE,OAAO,CAAC;IACvB,6DAA6D;IAC7D,mBAAmB,CAAC,EAAE;QACpB,uCAAuC;QACvC,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,sBAAsB;QACtB,cAAc,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;KAClC,CAAC;CACH;AAID;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,uBAAuB;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,4BAA4B;IAC5B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,cAAc;IACd,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,0BAA0B;IAC1B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,+BAA+B;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,qBAAqB;IACrB,SAAS,EAAE,QAAQ,CAAC;IACpB,mBAAmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iBAAiB;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,gBAAgB;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,+BAA+B;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,yCAAyC;IACzC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,uBAAuB;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB;IACrB,SAAS,EAAE,IAAI,CAAC;IAChB,iBAAiB;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,wBAAwB;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,2BAA2B;IAC3B,QAAQ,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,2BAA2B;IAC3B,QAAQ,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4BAA4B;IAC5B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,wBAAwB;IACxB,OAAO,EAAE,yBAAyB,GAAG,qBAAqB,CAAC;CAC5D;AAID;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,wBAAwB;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,uBAAuB;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,4CAA4C;IAC5C,aAAa,EAAE,OAAO,CAAC;IACvB,6DAA6D;IAC7D,mBAAmB,CAAC,EAAE;QACpB,uCAAuC;QACvC,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,sBAAsB;QACtB,cAAc,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;KAClC,CAAC;CACH;AAED;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,uBAAuB,GAAG,SAAS,GAAG,oBAAoB,CAAC;AAEvF;;;;GAIG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GACrC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,SAAS,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjF;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,sCAAsC;IACtC,mBAAmB,CAAC,EAAE;QACpB,uCAAuC;QACvC,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,sBAAsB;QACtB,cAAc,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;KAClC,CAAC;CACH;AAID;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oBAAoB;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,4BAA4B;IAC5B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,cAAc;IACd,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,0BAA0B;IAC1B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB"}

package/lib/types.js

@@ -1,8 +1,8 @@
-'use strict';
+"use strict";
 /**
  * Type definitions for cognito-auth middleware and utilities.
  *
  * @packageDocumentation
  */
-Object.defineProperty(exports, '__esModule', { value: true });
-//# sourceMappingURL=types.js.map
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fnd-platform/cognito-auth",
-  "version": "1.0.0-alpha.1",
+  "version": "1.0.0-alpha.10",
   "description": "AWS Cognito authentication constructs and middleware for fnd-platform applications",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",