@fnd-platform/cognito-auth 1.0.0-alpha.1

package/lib/utils/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,uDAK4B;AAJ1B,sHAAA,kBAAkB,OAAA;AAClB,oHAAA,gBAAgB,OAAA"}

package/lib/utils/token-refresh.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Token refresh utilities for server-side token management.
+ *
+ * @packageDocumentation
+ */
+/**
+ * Configuration for token refresh.
+ */
+export interface TokenRefreshConfig {
+  /** Cognito User Pool Client ID */
+  clientId: string;
+  /** AWS region (defaults to AWS_REGION env var) */
+  region?: string;
+}
+/**
+ * Result of token refresh.
+ */
+export interface RefreshResult {
+  /** New access token */
+  accessToken: string;
+  /** New ID token */
+  idToken: string;
+  /** Access token expiration in seconds */
+  expiresIn: number;
+}
+/**
+ * Refreshes access and ID tokens using a refresh token.
+ *
+ * This is useful for server-side scenarios where you need to
+ * refresh tokens programmatically (e.g., long-running jobs).
+ *
+ * For client-side refresh, use AWS Amplify or similar libraries.
+ *
+ * @param refreshToken - The refresh token from initial auth
+ * @param config - Refresh configuration
+ * @returns New access and ID tokens
+ * @throws Error if refresh fails
+ *
+ * @example
+ * ```typescript
+ * const result = await refreshAccessToken(storedRefreshToken, {
+ *   clientId: process.env.COGNITO_CLIENT_ID!,
+ * });
+ * console.log(result.accessToken);
+ * ```
+ */
+export declare function refreshAccessToken(
+  refreshToken: string,
+  config: TokenRefreshConfig
+): Promise<RefreshResult>;
+/**
+ * Clears the Cognito client cache. Useful for testing.
+ *
+ * @example
+ * ```typescript
+ * beforeEach(() => {
+ *   clearClientCache();
+ * });
+ * ```
+ */
+export declare function clearClientCache(): void;
+//# sourceMappingURL=token-refresh.d.ts.map

package/lib/utils/token-refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-refresh.d.ts","sourceRoot":"","sources":["../../src/utils/token-refresh.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,uBAAuB;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;CACnB;AAoBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,aAAa,CAAC,CA4BxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC"}

package/lib/utils/token-refresh.js

@@ -0,0 +1,84 @@
+'use strict';
+/**
+ * Token refresh utilities for server-side token management.
+ *
+ * @packageDocumentation
+ */
+Object.defineProperty(exports, '__esModule', { value: true });
+exports.refreshAccessToken = refreshAccessToken;
+exports.clearClientCache = clearClientCache;
+const client_cognito_identity_provider_1 = require('@aws-sdk/client-cognito-identity-provider');
+/** Client cache for reuse */
+let cognitoClient = null;
+/**
+ * Gets or creates a Cognito client.
+ *
+ * @param region - AWS region
+ * @returns Cognito Identity Provider client
+ */
+function getClient(region) {
+  if (!cognitoClient) {
+    cognitoClient = new client_cognito_identity_provider_1.CognitoIdentityProviderClient({
+      region: region ?? process.env.AWS_REGION,
+    });
+  }
+  return cognitoClient;
+}
+/**
+ * Refreshes access and ID tokens using a refresh token.
+ *
+ * This is useful for server-side scenarios where you need to
+ * refresh tokens programmatically (e.g., long-running jobs).
+ *
+ * For client-side refresh, use AWS Amplify or similar libraries.
+ *
+ * @param refreshToken - The refresh token from initial auth
+ * @param config - Refresh configuration
+ * @returns New access and ID tokens
+ * @throws Error if refresh fails
+ *
+ * @example
+ * ```typescript
+ * const result = await refreshAccessToken(storedRefreshToken, {
+ *   clientId: process.env.COGNITO_CLIENT_ID!,
+ * });
+ * console.log(result.accessToken);
+ * ```
+ */
+async function refreshAccessToken(refreshToken, config) {
+  const client = getClient(config.region);
+  const command = new client_cognito_identity_provider_1.InitiateAuthCommand({
+    AuthFlow: client_cognito_identity_provider_1.AuthFlowType.REFRESH_TOKEN_AUTH,
+    ClientId: config.clientId,
+    AuthParameters: {
+      REFRESH_TOKEN: refreshToken,
+    },
+  });
+  const response = await client.send(command);
+  if (!response.AuthenticationResult) {
+    throw new Error('Token refresh failed: No authentication result');
+  }
+  const { AccessToken, IdToken, ExpiresIn } = response.AuthenticationResult;
+  if (!AccessToken || !IdToken) {
+    throw new Error('Token refresh failed: Missing tokens in response');
+  }
+  return {
+    accessToken: AccessToken,
+    idToken: IdToken,
+    expiresIn: ExpiresIn ?? 3600,
+  };
+}
+/**
+ * Clears the Cognito client cache. Useful for testing.
+ *
+ * @example
+ * ```typescript
+ * beforeEach(() => {
+ *   clearClientCache();
+ * });
+ * ```
+ */
+function clearClientCache() {
+  cognitoClient = null;
+}
+//# sourceMappingURL=token-refresh.js.map

package/lib/utils/token-refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-refresh.js","sourceRoot":"","sources":["../../src/utils/token-refresh.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAqEH,gDA+BC;AAYD,4CAEC;AAhHD,gGAImD;AAwBnD,6BAA6B;AAC7B,IAAI,aAAa,GAAyC,IAAI,CAAC;AAE/D;;;;;GAKG;AACH,SAAS,SAAS,CAAC,MAAe;IAChC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,aAAa,GAAG,IAAI,gEAA6B,CAAC;YAChD,MAAM,EAAE,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU;SACzC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACI,KAAK,UAAU,kBAAkB,CACtC,YAAoB,EACpB,MAA0B;IAE1B,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAExC,MAAM,OAAO,GAAG,IAAI,sDAAmB,CAAC;QACtC,QAAQ,EAAE,+CAAY,CAAC,kBAAkB;QACzC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc,EAAE;YACd,aAAa,EAAE,YAAY;SAC5B;KACF,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAE5C,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC,oBAAoB,CAAC;IAE1E,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,OAAO;QACL,WAAW,EAAE,WAAW;QACxB,OAAO,EAAE,OAAO;QAChB,SAAS,EAAE,SAAS,IAAI,IAAI;KAC7B,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,gBAAgB;IAC9B,aAAa,GAAG,IAAI,CAAC;AACvB,CAAC"}

package/package.json

@@ -0,0 +1,70 @@
+{
+  "name": "@fnd-platform/cognito-auth",
+  "version": "1.0.0-alpha.1",
+  "description": "AWS Cognito authentication constructs and middleware for fnd-platform applications",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "files": [
+    "lib/"
+  ],
+  "dependencies": {
+    "aws-jwt-verify": "^4.0.0"
+  },
+  "peerDependencies": {
+    "aws-cdk-lib": "^2.130.0",
+    "constructs": "^10.3.0",
+    "@aws-sdk/client-cognito-identity-provider": "^3.0.0",
+    "@remix-run/node": "^2.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@aws-sdk/client-cognito-identity-provider": {
+      "optional": true
+    },
+    "@remix-run/node": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@aws-sdk/client-cognito-identity-provider": "^3.500.0",
+    "@remix-run/node": "^2.15.0",
+    "@types/aws-lambda": "^8.10.145",
+    "@types/node": "^20.0.0",
+    "@typescript-eslint/eslint-plugin": "^7.18.0",
+    "@typescript-eslint/parser": "^7.18.0",
+    "@vitest/coverage-v8": "^1.6.0",
+    "aws-cdk-lib": "^2.130.0",
+    "constructs": "^10.3.0",
+    "eslint": "^8.57.0",
+    "typescript": "^5.6.3",
+    "vitest": "^1.6.0"
+  },
+  "keywords": [
+    "cdk",
+    "aws",
+    "cognito",
+    "authentication",
+    "user-pool",
+    "constructs",
+    "middleware",
+    "jwt",
+    "authorizer",
+    "remix",
+    "session"
+  ],
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/your-org/fnd-platform",
+    "directory": "packages/cognito-auth"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    "lint": "eslint src/ test/"
+  }
+}