@hatkom/aws-auth 1.4.5 → 1.5.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +14 -0
- package/README.md +36 -3
- package/dist/auth.d.ts +9 -1
- package/dist/auth.js +22 -11
- package/dist/auth.js.map +1 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,3 +1,17 @@
|
|
|
1
|
+
## [1.5.1](https://github.com/Hatkom-io/aws-auth/compare/v1.5.0...v1.5.1) (2026-09-22)
|
|
2
|
+
|
|
3
|
+
|
|
4
|
+
### Bug Fixes
|
|
5
|
+
|
|
6
|
+
* handle error on signOut ([01d5500](https://github.com/Hatkom-io/aws-auth/commit/01d55009fa5982701ef1b2dfb1ce5d49db06d624))
|
|
7
|
+
|
|
8
|
+
# [1.5.0](https://github.com/Hatkom-io/aws-auth/compare/v1.4.5...v1.5.0) (2026-09-16)
|
|
9
|
+
|
|
10
|
+
|
|
11
|
+
### Features
|
|
12
|
+
|
|
13
|
+
* adopt external session, select token use ([3b70040](https://github.com/Hatkom-io/aws-auth/commit/3b700408cf5e3675b330073eb867524c458ccd1b))
|
|
14
|
+
|
|
1
15
|
## [1.4.5](https://github.com/Hatkom-io/aws-auth/compare/v1.4.4...v1.4.5) (2026-03-24)
|
|
2
16
|
|
|
3
17
|
|
package/README.md
CHANGED
|
@@ -20,18 +20,51 @@ const session = await auth.authenticateUser({ email: 'user@example.com', passwor
|
|
|
20
20
|
|
|
21
21
|
// Get current session token (auto-refreshes if expired)
|
|
22
22
|
const token = await auth.getCurrentSessionToken()
|
|
23
|
+
const idToken = await auth.getCurrentSessionToken('id')
|
|
23
24
|
|
|
24
|
-
//
|
|
25
|
+
// Adopt a session obtained elsewhere (e.g. a server-mediated sign-in)
|
|
26
|
+
await auth.adoptSession({ username, idToken, accessToken, refreshToken })
|
|
27
|
+
|
|
28
|
+
// Sign out. Rejects when Cognito did not acknowledge the revocation
|
|
25
29
|
await auth.signOut()
|
|
26
30
|
```
|
|
27
31
|
|
|
28
32
|
## API
|
|
29
33
|
|
|
30
34
|
- `authenticateUser({ email, password })` — sign in, returns session or `'new-password-required'`
|
|
31
|
-
- `getCurrentSessionToken()` — returns current
|
|
32
|
-
- `
|
|
35
|
+
- `getCurrentSessionToken(tokenUse?)` — returns the current JWT, refreshing if needed. `tokenUse` is `'access'` (default) or `'id'`
|
|
36
|
+
- `adoptSession({ username, idToken, accessToken, refreshToken })` — store a session obtained outside the browser, so the SDK handles renewal, revocation and storage from then on
|
|
37
|
+
- `signOut()` — signs out the current user; rejects when the refresh token revocation failed
|
|
33
38
|
- `completeNewPasswordChallenge({ username, newPassword })` — complete a new password challenge
|
|
34
39
|
- `forgotPassword(username)` — initiate forgot password flow
|
|
35
40
|
- `forgotPasswordSubmit({ username, verificationCode, password })` — submit new password
|
|
36
41
|
- `resendVerificationCode(username)` — resend email verification code
|
|
37
42
|
- `verifyUserEmail({ username, code })` — confirm email registration
|
|
43
|
+
|
|
44
|
+
### `signOut`
|
|
45
|
+
|
|
46
|
+
Rejects when the revocation failed, so a caller that must guarantee the session ended has
|
|
47
|
+
something to catch. Two distinct failures reach the same rejection:
|
|
48
|
+
|
|
49
|
+
- the SDK could not refresh the session before revoking it — it returns **without clearing its
|
|
50
|
+
cached tokens**, so the refresh token is live both remotely and locally
|
|
51
|
+
- the `RevokeToken` call itself failed — the SDK clears its cached tokens first, so storage is
|
|
52
|
+
empty while the refresh token stays usable at Cognito until it expires
|
|
53
|
+
|
|
54
|
+
Emptied storage therefore says nothing about whether the remote session ended; only a resolved
|
|
55
|
+
`signOut()` does. Sign-out flows that navigate away should still do so on rejection, after
|
|
56
|
+
handling the local tokens themselves.
|
|
57
|
+
|
|
58
|
+
### `adoptSession`
|
|
59
|
+
|
|
60
|
+
Use it when sign-in happens on your server (`InitiateAuth` / `RespondToAuthChallenge`) and the
|
|
61
|
+
browser receives a finished `AuthenticationResult`. The tokens are cached under the same storage
|
|
62
|
+
keys a browser-side login writes, so `getCurrentSessionToken()`, refresh and `signOut()` all work
|
|
63
|
+
afterwards, including across a page reload.
|
|
64
|
+
|
|
65
|
+
`username` must be the **Cognito username**, not the e-mail. A pool configured with
|
|
66
|
+
`usernameAttributes: ['email']` generates a UUID internal username, and the cache keys are built
|
|
67
|
+
from it — passing the e-mail leaves nothing findable on the next page load.
|
|
68
|
+
|
|
69
|
+
If your API authorizes on e-mail, read the ID token (`getCurrentSessionToken('id')`): with a
|
|
70
|
+
UUID username the access token carries no `email` claim.
|
package/dist/auth.d.ts
CHANGED
|
@@ -16,6 +16,13 @@ type CompleteNewPasswordChallengeArgs = {
|
|
|
16
16
|
username: string;
|
|
17
17
|
newPassword: string;
|
|
18
18
|
};
|
|
19
|
+
type AdoptSessionArgs = {
|
|
20
|
+
username: string;
|
|
21
|
+
idToken: string;
|
|
22
|
+
accessToken: string;
|
|
23
|
+
refreshToken: string;
|
|
24
|
+
};
|
|
25
|
+
type TokenUse = 'access' | 'id';
|
|
19
26
|
declare class AWSAuthClient {
|
|
20
27
|
private userPool;
|
|
21
28
|
private syncStoragePromise;
|
|
@@ -27,7 +34,8 @@ declare class AWSAuthClient {
|
|
|
27
34
|
forgotPassword: (username: string) => Promise<unknown>;
|
|
28
35
|
forgotPasswordSubmit: ({ username, verificationCode, password, }: ForgotPasswordSubmitArgs) => Promise<unknown>;
|
|
29
36
|
authenticateUser: ({ email, password }: AuthenticateUserArgs) => Promise<CognitoUserSession | "new-password-required">;
|
|
30
|
-
|
|
37
|
+
adoptSession: ({ username, idToken, accessToken, refreshToken, }: AdoptSessionArgs) => Promise<void>;
|
|
38
|
+
getCurrentSessionToken: (tokenUse?: TokenUse) => Promise<string | null>;
|
|
31
39
|
private isValid;
|
|
32
40
|
private cognitoUser;
|
|
33
41
|
}
|
package/dist/auth.js
CHANGED
|
@@ -7,6 +7,7 @@ const needsToSyncStorage = (userPool) => !!('storage' in userPool &&
|
|
|
7
7
|
typeof userPool.storage === 'function' &&
|
|
8
8
|
'sync' in userPool.storage &&
|
|
9
9
|
typeof userPool.storage.sync === 'function');
|
|
10
|
+
const getToken = (session, tokenUse) => tokenUse === 'id' ? session.getIdToken() : session.getAccessToken();
|
|
10
11
|
class AWSAuthClient {
|
|
11
12
|
userPool;
|
|
12
13
|
syncStoragePromise;
|
|
@@ -29,14 +30,15 @@ class AWSAuthClient {
|
|
|
29
30
|
if (!user) {
|
|
30
31
|
return;
|
|
31
32
|
}
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
33
|
+
return new Promise((resolve, reject) => {
|
|
34
|
+
user.signOut((error) => {
|
|
35
|
+
if (error) {
|
|
36
|
+
reject(error);
|
|
37
|
+
return;
|
|
38
|
+
}
|
|
39
|
+
resolve();
|
|
35
40
|
});
|
|
36
|
-
}
|
|
37
|
-
catch (error) {
|
|
38
|
-
console.error('SignOut error', { extra: JSON.stringify(error) });
|
|
39
|
-
}
|
|
41
|
+
});
|
|
40
42
|
};
|
|
41
43
|
completeNewPasswordChallenge = ({ username, newPassword, }) => {
|
|
42
44
|
return new Promise((resolve, reject) => {
|
|
@@ -104,7 +106,15 @@ class AWSAuthClient {
|
|
|
104
106
|
});
|
|
105
107
|
});
|
|
106
108
|
};
|
|
107
|
-
|
|
109
|
+
adoptSession = async ({ username, idToken, accessToken, refreshToken, }) => {
|
|
110
|
+
await this.syncStoragePromise;
|
|
111
|
+
this.cognitoUser(username).setSignInUserSession(new amazon_cognito_identity_js_1.CognitoUserSession({
|
|
112
|
+
IdToken: new amazon_cognito_identity_js_1.CognitoIdToken({ IdToken: idToken }),
|
|
113
|
+
AccessToken: new amazon_cognito_identity_js_1.CognitoAccessToken({ AccessToken: accessToken }),
|
|
114
|
+
RefreshToken: new amazon_cognito_identity_js_1.CognitoRefreshToken({ RefreshToken: refreshToken }),
|
|
115
|
+
}));
|
|
116
|
+
};
|
|
117
|
+
getCurrentSessionToken = async (tokenUse = 'access') => {
|
|
108
118
|
await this.syncStoragePromise;
|
|
109
119
|
const currentUser = this.userPool.getCurrentUser();
|
|
110
120
|
if (!currentUser) {
|
|
@@ -120,9 +130,10 @@ class AWSAuthClient {
|
|
|
120
130
|
}
|
|
121
131
|
});
|
|
122
132
|
});
|
|
123
|
-
const
|
|
133
|
+
const currentToken = getToken(session, tokenUse);
|
|
134
|
+
const valid = this.isValid(currentToken.getExpiration());
|
|
124
135
|
if (valid) {
|
|
125
|
-
return
|
|
136
|
+
return currentToken.getJwtToken();
|
|
126
137
|
}
|
|
127
138
|
const updatedSession = await new Promise((resolve, reject) => {
|
|
128
139
|
currentUser.refreshSession(session.getRefreshToken(), (error, value) => {
|
|
@@ -134,7 +145,7 @@ class AWSAuthClient {
|
|
|
134
145
|
}
|
|
135
146
|
});
|
|
136
147
|
});
|
|
137
|
-
return updatedSession
|
|
148
|
+
return getToken(updatedSession, tokenUse).getJwtToken();
|
|
138
149
|
};
|
|
139
150
|
isValid = (tokenExpiration) => {
|
|
140
151
|
const now = Math.floor(new Date().getTime() / 1000);
|
package/dist/auth.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":";;;AAAA,
|
|
1
|
+
{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":";;;AAAA,2EAQmC;AA8QX,mGA/QtB,+CAAkB,OA+QsB;AA1O1C,MAAM,kBAAkB,GAAG,CACzB,QAAyB,EACgB,EAAE,CAC3C,CAAC,CAAC,CACA,SAAS,IAAI,QAAQ;IACrB,OAAO,QAAQ,CAAC,OAAO,KAAK,UAAU;IACtC,MAAM,IAAI,QAAQ,CAAC,OAAO;IAC1B,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU,CAC5C,CAAA;AAEH,MAAM,QAAQ,GAAG,CAAC,OAA2B,EAAE,QAAkB,EAAE,EAAE,CACnE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,CAAA;AAErE,MAAM,aAAa;IACT,QAAQ,CAAiB;IACzB,kBAAkB,CAAe;IAEzC,YAAY,UAAkB,EAAE,QAAgB;QAC9C,IAAI,CAAC,QAAQ,GAAG,IAAI,4CAAe,CAAC;YAClC,UAAU;YACV,QAAQ;SACT,CAAC,CAAA;QAEF,IAAI,CAAC,kBAAkB,GAAG,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAChD,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBAEnC,OAAM;YACR,CAAC;YAED,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,GAAG,KAAK,IAAI,EAAE;QACnB,MAAM,IAAI,CAAC,kBAAkB,CAAA;QAE7B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAA;QAE3C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAM;QACR,CAAC;QAED,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,IAAI,CAAC,OAAO,CAAC,CAAC,KAAa,EAAE,EAAE;gBAC7B,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,CAAC,KAAK,CAAC,CAAA;oBAEb,OAAM;gBACR,CAAC;gBAED,OAAO,EAAE,CAAA;YACX,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,4BAA4B,GAAG,CAAC,EAC9B,QAAQ,EACR,WAAW,GACsB,EAAE,EAAE;QACrC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,4BAA4B,CAAC,WAAW,EAAE,EAAE,EAAE;gBACvE,SAAS,EAAE,OAAO;gBAClB,SAAS,EAAE,MAAM;aAClB,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,sBAAsB,GAAG,KAAK,EAAE,QAAgB,EAAE,EAAE;QAClD,MAAM,IAAI,CAAC,kBAAkB,CAAA;QAE7B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,sBAAsB,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;gBAChE,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,CAAC,GAAG,CAAC,CAAA;oBAEX,OAAM;gBACR,CAAC;gBAED,OAAO,CAAC,MAAM,CAAC,CAAA;YACjB,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,eAAe,GAAG,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAuB,EAAE,EAAE;QAClE,MAAM,IAAI,CAAC,kBAAkB,CAAA;QAE7B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;gBACnE,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,CAAC,KAAK,CAAC,CAAA;oBAEb,OAAM;gBACR,CAAC;gBAED,OAAO,CAAC,IAAI,CAAC,CAAA;YACf,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,cAAc,GAAG,KAAK,EAAE,QAAgB,EAAE,EAAE;QAC1C,MAAM,IAAI,CAAC,kBAAkB,CAAA;QAE7B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC;gBACxC,SAAS,EAAE,OAAO;gBAClB,SAAS,EAAE,MAAM;aAClB,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,oBAAoB,GAAG,KAAK,EAAE,EAC5B,QAAQ,EACR,gBAAgB,EAChB,QAAQ,GACiB,EAAE,EAAE;QAC7B,MAAM,IAAI,CAAC,kBAAkB,CAAA;QAE7B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,eAAe,CAAC,gBAAgB,EAAE,QAAQ,EAAE;gBACrE,SAAS,EAAE,OAAO;gBAClB,SAAS,EAAE,MAAM;aAClB,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,gBAAgB,GAAG,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAwB,EAAE,EAAE;QACrE,MAAM,IAAI,CAAC,kBAAkB,CAAA;QAE7B,MAAM,qBAAqB,GAAG,IAAI,kDAAqB,CAAC;YACtD,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAA;QAEF,OAAO,IAAI,OAAO,CAChB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAClB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,qBAAqB,EAAE;gBAC9D,SAAS,EAAE,OAAO;gBAClB,SAAS,EAAE,MAAM;gBACjB,mBAAmB,EAAE,GAAG,EAAE;oBACxB,OAAO,CAAC,uBAAuB,CAAC,CAAA;gBAClC,CAAC;aACF,CAAC,CAAA;QACJ,CAAC,CACF,CAAA;IACH,CAAC,CAAA;IAED,YAAY,GAAG,KAAK,EAAE,EACpB,QAAQ,EACR,OAAO,EACP,WAAW,EACX,YAAY,GACK,EAAE,EAAE;QACrB,MAAM,IAAI,CAAC,kBAAkB,CAAA;QAE7B,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CAC7C,IAAI,+CAAkB,CAAC;YACrB,OAAO,EAAE,IAAI,2CAAc,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YACjD,WAAW,EAAE,IAAI,+CAAkB,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;YACjE,YAAY,EAAE,IAAI,gDAAmB,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;SACtE,CAAC,CACH,CAAA;IACH,CAAC,CAAA;IAED,sBAAsB,GAAG,KAAK,EAAE,WAAqB,QAAQ,EAAE,EAAE;QAC/D,MAAM,IAAI,CAAC,kBAAkB,CAAA;QAE7B,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAA;QAElD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,OAAO,CAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACxE,WAAW,CAAC,UAAU,CACpB,CAAC,GAAiB,EAAE,CAA4B,EAAE,EAAE;gBAClD,IAAI,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;oBACd,MAAM,CAAC,GAAG,CAAC,CAAA;gBACb,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,CAAC,CAAC,CAAA;gBACZ,CAAC;YACH,CAAC,CACF,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAEhD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC,CAAA;QAExD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,YAAY,CAAC,WAAW,EAAE,CAAA;QACnC,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,IAAI,OAAO,CACtC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAClB,WAAW,CAAC,cAAc,CACxB,OAAO,CAAC,eAAe,EAAE,EACzB,CAAC,KAAK,EAAE,KAAyB,EAAE,EAAE;gBACnC,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,CAAC,KAAK,CAAC,CAAA;gBACf,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,KAAK,CAAC,CAAA;gBAChB,CAAC;YACH,CAAC,CACF,CAAA;QACH,CAAC,CACF,CAAA;QAED,OAAO,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAA;IACzD,CAAC,CAAA;IAEO,OAAO,GAAG,CAAC,eAAuB,EAAE,EAAE;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAA;QACnD,MAAM,QAAQ,GAAG,GAAG,GAAG,EAAE,CAAA;QAEzB,OAAO,QAAQ,GAAG,eAAe,CAAA;IACnC,CAAC,CAAA;IAEO,WAAW,GAAG,CAAC,GAAG,EAAE;QAC1B,IAAI,IAA6B,CAAA;QAEjC,OAAO,CAAC,QAAgB,EAAE,EAAE;YAC1B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC7C,IAAI,GAAG,IAAI,wCAAW,CAAC;oBACrB,QAAQ,EAAE,QAAQ;oBAClB,IAAI,EAAE,IAAI,CAAC,QAAQ;iBACpB,CAAC,CAAA;YACJ,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC,CAAA;IACH,CAAC,CAAC,EAAE,CAAA;CACL;AAEQ,sCAAa"}
|