@massimo.mazzoleni/cognito-max 1.0.0 → 1.1.0

package/dist/{chunk-DKPFVGTY.js → chunk-GNMHM6IU.js}

@@ -1,4 +1,4 @@
-import { CognitoUserPool, AuthenticationDetails, CognitoUserAttribute, CognitoUser, CognitoRefreshToken } from 'amazon-cognito-identity-js';
+import { CognitoUserPool, AuthenticationDetails, CognitoIdToken, CognitoAccessToken, CognitoRefreshToken, CognitoUserSession, CognitoUserAttribute, CognitoUser } from 'amazon-cognito-identity-js';
 import { GetUserCommand, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';
 
 // src/core/errors.ts
@@ -186,7 +186,27 @@ function buildAuthUser(session, fallbackUsername) {
   };
 }
 
+// src/core/internal/pkce.ts
+function base64UrlEncode(bytes) {
+  let binary = "";
+  for (const b of bytes) binary += String.fromCharCode(b);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function generateRandomString(length = 64) {
+  const bytes = new Uint8Array(length);
+  crypto.getRandomValues(bytes);
+  return base64UrlEncode(bytes).slice(0, length);
+}
+async function createPkcePair() {
+  const verifier = generateRandomString(64);
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  const challenge = base64UrlEncode(new Uint8Array(digest));
+  return { verifier, challenge };
+}
+
 // src/core/client.ts
+var FEDERATED_PKCE_STORAGE_KEY = "cognito-max.federated.pkce_verifier";
+var FEDERATED_STATE_STORAGE_KEY = "cognito-max.federated.state";
 function validateConfig(config) {
   const missing = ["userPoolId", "clientId", "region"].filter((k) => !config[k]);
   if (missing.length) {
@@ -211,12 +231,22 @@ var CognitoAuthClient = class extends TypedEventEmitter {
     this._pendingChallenges = /* @__PURE__ */ new Map();
     this._refreshTimer = null;
     validateConfig(config);
+    const { passwordPolicy, ...rest } = config;
     this.config = {
       autoRefresh: true,
       refreshMarginSeconds: 300,
       totpIssuer: config.clientId,
       storage: new AutoStorageAdapter(),
-      ...config
+      deviceTracking: false,
+      ...rest,
+      passwordPolicy: {
+        minLength: 8,
+        requireUppercase: false,
+        requireLowercase: false,
+        requireNumbers: false,
+        requireSymbols: false,
+        ...passwordPolicy
+      }
     };
     this._pool = new CognitoUserPool({
       UserPoolId: this.config.userPoolId,
@@ -230,6 +260,14 @@ var CognitoAuthClient = class extends TypedEventEmitter {
   get state() {
     return this._state;
   }
+  /**
+   * Lo StorageAdapter configurato (esplicito o AutoStorageAdapter di default). Utile per
+   * consumer che vogliono ispezionarlo/estenderlo (es. un adapter "remember me" che decide a
+   * runtime se persistere su localStorage o solo su sessionStorage).
+   */
+  get storage() {
+    return this.config.storage;
+  }
   setState(next) {
     if (this._state === next) return;
     this._state = next;
@@ -279,6 +317,153 @@ var CognitoAuthClient = class extends TypedEventEmitter {
       });
     });
   }
+  /**
+   * Avvia il flusso CUSTOM_AUTH (passwordless / OTP custom / magic link, ecc.). Richiede che il
+   * User Pool abbia configurato i Lambda trigger DefineAuthChallenge/CreateAuthChallenge/
+   * VerifyAuthChallengeResponse — questa libreria si limita a parlare il protocollo lato client,
+   * la logica della sfida (es. invio di un OTP via email) è responsabilità di quei trigger.
+   * clientMetadata è passato al trigger CreateAuthChallenge (es. per includere un redirect URL).
+   */
+  async signInPasswordless(username, clientMetadata) {
+    this.setState("loading");
+    const cognitoUser = this._makeCognitoUser(username);
+    cognitoUser.setAuthenticationFlowType("CUSTOM_AUTH");
+    const authDetails = new AuthenticationDetails({ Username: username, ClientMetadata: clientMetadata });
+    return new Promise((resolve, reject) => {
+      cognitoUser.initiateAuth(authDetails, {
+        onSuccess: (session) => resolve(this._onAuthSuccess(cognitoUser, session)),
+        onFailure: (err) => {
+          this.setState("unauthenticated");
+          reject(mapCognitoError(err));
+        },
+        customChallenge: (challengeParameters) => {
+          this.setState("custom_challenge_required");
+          const challengeSession = this._storeChallengeUser(cognitoUser);
+          const params = challengeParameters ?? {};
+          this.emit("customChallengeRequired", { challengeSession, challengeParameters: params });
+          resolve({ status: "CUSTOM_CHALLENGE_REQUIRED", challengeSession, challengeParameters: params });
+        }
+      });
+    });
+  }
+  /**
+   * Risponde a una sfida CUSTOM_AUTH (es. il codice OTP ricevuto). Il Lambda
+   * DefineAuthChallenge del pool decide se la sequenza è completa (SUCCESS) o se propone
+   * un'altra sfida (CUSTOM_CHALLENGE_REQUIRED di nuovo, con un nuovo challengeSession).
+   */
+  async respondToCustomChallenge(challengeSession, answer, clientMetadata) {
+    const cognitoUser = this._takeChallengeUser(challengeSession);
+    return new Promise((resolve, reject) => {
+      cognitoUser.sendCustomChallengeAnswer(
+        answer,
+        {
+          onSuccess: (session) => resolve(this._onAuthSuccess(cognitoUser, session)),
+          onFailure: (err) => {
+            this.setState("unauthenticated");
+            reject(mapCognitoError(err));
+          },
+          customChallenge: (challengeParameters) => {
+            this.setState("custom_challenge_required");
+            const newSession = this._storeChallengeUser(cognitoUser);
+            const params = challengeParameters ?? {};
+            this.emit("customChallengeRequired", { challengeSession: newSession, challengeParameters: params });
+            resolve({ status: "CUSTOM_CHALLENGE_REQUIRED", challengeSession: newSession, challengeParameters: params });
+          }
+        },
+        clientMetadata
+      );
+    });
+  }
+  // ─── Federated login (Hosted UI / OAuth2 + PKCE) ────────────────────────────
+  //
+  // Richiede AuthConfig.federated configurato e il dominio Hosted UI abilitato sul User Pool.
+  // Il round-trip passa da una navigazione a pagina intera verso Cognito: usa storage
+  // persistente (localStorage/sessionStorage, non InMemoryStorageAdapter) altrimenti il
+  // code_verifier PKCE generato prima del redirect va perso al ritorno.
+  /**
+   * Costruisce l'URL di autorizzazione Hosted UI (Authorization Code + PKCE). Naviga il browser
+   * su questo URL (window.location.href = url); l'utente torna sul redirectUri configurato con
+   * ?code=...&state=... da passare a handleFederatedCallback().
+   */
+  async getFederatedSignInUrl(options) {
+    const federated = this._requireFederatedConfig();
+    const { verifier, challenge } = await createPkcePair();
+    const state = options?.state ?? crypto.randomUUID();
+    this.config.storage.setItem(FEDERATED_PKCE_STORAGE_KEY, verifier);
+    this.config.storage.setItem(FEDERATED_STATE_STORAGE_KEY, state);
+    const params = new URLSearchParams({
+      client_id: this.config.clientId,
+      response_type: "code",
+      scope: (federated.scopes ?? ["openid", "email", "profile"]).join(" "),
+      redirect_uri: federated.redirectUri,
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+      state
+    });
+    if (options?.provider) params.set("identity_provider", options.provider);
+    return `https://${federated.domain}/oauth2/authorize?${params.toString()}`;
+  }
+  /**
+   * Da chiamare nella pagina di callback (redirectUri) con { code, state } letti dalla query
+   * string. Scambia il code per i token via /oauth2/token (PKCE, nessun client secret), poi
+   * costruisce una sessione Cognito standard esattamente come un login SRP riuscito.
+   */
+  async handleFederatedCallback(params) {
+    const federated = this._requireFederatedConfig();
+    const verifier = this.config.storage.getItem(FEDERATED_PKCE_STORAGE_KEY);
+    const expectedState = this.config.storage.getItem(FEDERATED_STATE_STORAGE_KEY);
+    this.config.storage.removeItem(FEDERATED_PKCE_STORAGE_KEY);
+    this.config.storage.removeItem(FEDERATED_STATE_STORAGE_KEY);
+    if (!verifier) {
+      throw new CognitoAuthError(
+        "Nessun code_verifier PKCE trovato: il flusso federato non risulta avviato da questo browser/storage",
+        "INVALID_PARAMETER"
+      );
+    }
+    if (params.state && expectedState && params.state !== expectedState) {
+      throw new CognitoAuthError(
+        "Parametro state non corrispondente \u2014 possibile CSRF, login federato rifiutato",
+        "INVALID_PARAMETER"
+      );
+    }
+    const body = new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: this.config.clientId,
+      code: params.code,
+      redirect_uri: federated.redirectUri,
+      code_verifier: verifier
+    });
+    let response;
+    try {
+      response = await fetch(`https://${federated.domain}/oauth2/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: body.toString()
+      });
+    } catch (err) {
+      throw new CognitoAuthError("Rete non raggiungibile durante lo scambio token OAuth2", "NETWORK_ERROR", err);
+    }
+    if (!response.ok) {
+      const text = await response.text().catch(() => "");
+      throw new CognitoAuthError(`Scambio token OAuth2 fallito (${response.status}): ${text}`, "UNKNOWN");
+    }
+    const tokens = await response.json();
+    if (!tokens.id_token || !tokens.access_token || !tokens.refresh_token) {
+      throw new CognitoAuthError(
+        "Risposta /oauth2/token incompleta (manca id_token/access_token/refresh_token)",
+        "UNKNOWN"
+      );
+    }
+    const idToken = new CognitoIdToken({ IdToken: tokens.id_token });
+    const payload = idToken.decodePayload();
+    const username = String(payload["cognito:username"] ?? payload["sub"]);
+    const cognitoUser = this._makeCognitoUser(username);
+    const accessToken = new CognitoAccessToken({ AccessToken: tokens.access_token });
+    const refreshToken = new CognitoRefreshToken({ RefreshToken: tokens.refresh_token });
+    const session = new CognitoUserSession({ IdToken: idToken, AccessToken: accessToken, RefreshToken: refreshToken });
+    cognitoUser.setSignInUserSession(session);
+    return this._onAuthSuccess(cognitoUser, session);
+  }
   async respondToMfaChallenge(challengeSession, code, mfaType) {
     const cognitoUser = this._takeChallengeUser(challengeSession);
     const sdkType = mfaType === "TOTP" ? "SOFTWARE_TOKEN_MFA" : "SMS_MFA";
@@ -353,7 +538,12 @@ var CognitoAuthClient = class extends TypedEventEmitter {
     }
   }
   // ─── Registration ──────────────────────────────────────────────────────────
-  async signUp(email, password, attributes = {}) {
+  /**
+   * clientMetadata è passato as-is a Cognito (ValidationData/ClientMetadata) ed è disponibile
+   * nell'evento per un Lambda trigger (es. PreSignUp) — usalo per far verificare lato server un
+   * token reCAPTCHA/hCaptcha raccolto in UI, la libreria non fa alcuna verifica CAPTCHA da sé.
+   */
+  async signUp(email, password, attributes = {}, clientMetadata) {
     const userAttributes = Object.entries({ email, ...attributes }).map(
       ([Name, Value]) => new CognitoUserAttribute({ Name, Value })
     );
@@ -361,29 +551,29 @@ var CognitoAuthClient = class extends TypedEventEmitter {
       this._pool.signUp(email, password, userAttributes, [], (err) => {
         if (err) return reject(mapCognitoError(err));
         resolve();
-      });
+      }, clientMetadata);
     });
   }
-  async confirmSignUp(email, code) {
+  async confirmSignUp(email, code, clientMetadata) {
     const cognitoUser = this._makeCognitoUser(email);
     await new Promise((resolve, reject) => {
       cognitoUser.confirmRegistration(code, true, (err) => {
         if (err) return reject(mapCognitoError(err));
         resolve();
-      });
+      }, clientMetadata);
     });
   }
-  async resendConfirmationCode(email) {
+  async resendConfirmationCode(email, clientMetadata) {
     const cognitoUser = this._makeCognitoUser(email);
     await new Promise((resolve, reject) => {
       cognitoUser.resendConfirmationCode((err) => {
         if (err) return reject(mapCognitoError(err));
         resolve();
-      });
+      }, clientMetadata);
     });
   }
   // ─── Password ──────────────────────────────────────────────────────────────
-  async forgotPassword(email) {
+  async forgotPassword(email, clientMetadata) {
     const cognitoUser = this._makeCognitoUser(email);
     await new Promise((resolve, reject) => {
       cognitoUser.forgotPassword({
@@ -391,25 +581,25 @@ var CognitoAuthClient = class extends TypedEventEmitter {
         inputVerificationCode: () => resolve(),
         onSuccess: () => resolve(),
         onFailure: (err) => reject(mapCognitoError(err))
-      });
+      }, clientMetadata);
     });
   }
-  async confirmForgotPassword(email, code, newPassword) {
+  async confirmForgotPassword(email, code, newPassword, clientMetadata) {
     const cognitoUser = this._makeCognitoUser(email);
     await new Promise((resolve, reject) => {
       cognitoUser.confirmPassword(code, newPassword, {
         onSuccess: () => resolve(),
         onFailure: (err) => reject(mapCognitoError(err))
-      });
+      }, clientMetadata);
     });
   }
-  async changePassword(currentPassword, newPassword) {
+  async changePassword(currentPassword, newPassword, clientMetadata) {
     const cognitoUser = await this._getAuthenticatedUser();
     await new Promise((resolve, reject) => {
       cognitoUser.changePassword(currentPassword, newPassword, (err) => {
         if (err) return reject(mapCognitoError(err));
         resolve();
-      });
+      }, clientMetadata);
     });
   }
   // ─── Session & User ────────────────────────────────────────────────────────
@@ -489,7 +679,7 @@ var CognitoAuthClient = class extends TypedEventEmitter {
     return new Promise((resolve, reject) => {
       cognitoUser.associateSoftwareToken({
         associateSecretCode: (secretCode) => {
-          const issuer = encodeURIComponent(this.config.totpIssuer);
+          const issuer = encodeURIComponent(this._resolveTotpIssuer());
           const account = encodeURIComponent(cognitoUser.getUsername());
           const qrCodeUri = `otpauth://totp/${issuer}:${account}?secret=${secretCode}&issuer=${issuer}`;
           resolve({ secretCode, qrCodeUri });
@@ -501,7 +691,7 @@ var CognitoAuthClient = class extends TypedEventEmitter {
   async verifyTotpSetup(code) {
     const cognitoUser = await this._getAuthenticatedUser();
     return new Promise((resolve, reject) => {
-      cognitoUser.verifySoftwareToken(code, this.config.totpIssuer, {
+      cognitoUser.verifySoftwareToken(code, this._resolveTotpIssuer(), {
         onSuccess: () => resolve(),
         onFailure: (err) => reject(mapCognitoError(err))
       });
@@ -547,6 +737,90 @@ var CognitoAuthClient = class extends TypedEventEmitter {
       });
     });
   }
+  // ─── Device tracking ────────────────────────────────────────────────────────
+  //
+  // Richiede che il User Pool abbia "Remember user devices" attivo: in quel caso Cognito
+  // conferma automaticamente il dispositivo durante l'autenticazione (nessuna chiamata
+  // esplicita richiesta qui, lo fa amazon-cognito-identity-js internamente). Queste API
+  // servono solo a "ricordare" (skip MFA) o dimenticare il dispositivo già confermato.
+  /** true/false per ricordare o smettere di ricordare il dispositivo corrente (skip MFA). */
+  async rememberCurrentDevice(remember) {
+    this._requireDeviceTracking();
+    const cognitoUser = await this._getAuthenticatedUser();
+    cognitoUser.getCachedDeviceKeyAndPassword();
+    return new Promise((resolve, reject) => {
+      const callbacks = {
+        onSuccess: () => resolve(),
+        onFailure: (err) => reject(mapCognitoError(err))
+      };
+      if (remember) {
+        cognitoUser.setDeviceStatusRemembered(callbacks);
+      } else {
+        cognitoUser.setDeviceStatusNotRemembered(callbacks);
+      }
+    });
+  }
+  /** Dimentica del tutto il dispositivo corrente (richiederà di nuovo MFA al prossimo login). */
+  async forgetCurrentDevice() {
+    this._requireDeviceTracking();
+    const cognitoUser = await this._getAuthenticatedUser();
+    cognitoUser.getCachedDeviceKeyAndPassword();
+    return new Promise((resolve, reject) => {
+      cognitoUser.forgetDevice({
+        onSuccess: () => resolve(),
+        onFailure: (err) => reject(mapCognitoError(err))
+      });
+    });
+  }
+  /** Elenca i dispositivi noti a Cognito per l'utente corrente. */
+  async listDevices(limit = 20) {
+    this._requireDeviceTracking();
+    const cognitoUser = await this._getAuthenticatedUser();
+    cognitoUser.getCachedDeviceKeyAndPassword();
+    return new Promise((resolve, reject) => {
+      cognitoUser.listDevices(limit, null, {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        onSuccess: (data) => {
+          const devices = (data?.Devices ?? []).map((d) => {
+            const attrs = Object.fromEntries(
+              // eslint-disable-next-line @typescript-eslint/no-explicit-any
+              (d.DeviceAttributes ?? []).map((a) => [a.Name, a.Value])
+            );
+            return {
+              deviceKey: d.DeviceKey,
+              deviceName: attrs["device_name"] ?? null,
+              createDate: d.DeviceCreateDate ? new Date(d.DeviceCreateDate * 1e3) : null,
+              lastAuthenticatedDate: d.DeviceLastAuthenticatedDate ? new Date(d.DeviceLastAuthenticatedDate * 1e3) : null,
+              lastModifiedDate: d.DeviceLastModifiedDate ? new Date(d.DeviceLastModifiedDate * 1e3) : null,
+              attributes: attrs
+            };
+          });
+          resolve(devices);
+        },
+        onFailure: (err) => reject(mapCognitoError(err))
+      });
+    });
+  }
+  // ─── Password policy ────────────────────────────────────────────────────────
+  /**
+   * Restituisce la policy password dichiarata in AuthConfig.passwordPolicy (con i default
+   * applicati). Non è letta da Cognito: va tenuta allineata a mano alla policy reale del User
+   * Pool (DescribeUserPoolCommand richiede credenziali IAM non disponibili da una SPA anonima).
+   */
+  getPasswordPolicy() {
+    return this.config.passwordPolicy;
+  }
+  /** Valida una password contro la policy configurata. Ritorna le violazioni, vuoto se ok. */
+  validatePassword(password) {
+    const policy = this.config.passwordPolicy;
+    const violations = [];
+    if (password.length < policy.minLength) violations.push("TOO_SHORT");
+    if (policy.requireUppercase && !/[A-Z]/.test(password)) violations.push("MISSING_UPPERCASE");
+    if (policy.requireLowercase && !/[a-z]/.test(password)) violations.push("MISSING_LOWERCASE");
+    if (policy.requireNumbers && !/[0-9]/.test(password)) violations.push("MISSING_NUMBER");
+    if (policy.requireSymbols && !/[^A-Za-z0-9]/.test(password)) violations.push("MISSING_SYMBOL");
+    return violations;
+  }
   // ─── TOTP setup durante il challenge login ─────────────────────────────────
   /**
    * Ottiene il secretCode/QR URI per il setup TOTP durante il flusso di login
@@ -558,7 +832,7 @@ var CognitoAuthClient = class extends TypedEventEmitter {
     return new Promise((resolve, reject) => {
       cognitoUser.associateSoftwareToken({
         associateSecretCode: (secretCode) => {
-          const issuer = encodeURIComponent(this.config.totpIssuer);
+          const issuer = encodeURIComponent(this._resolveTotpIssuer());
           const account = encodeURIComponent(cognitoUser.getUsername());
           const qrCodeUri = `otpauth://totp/${issuer}:${account}?secret=${secretCode}&issuer=${issuer}`;
           resolve({ secretCode, qrCodeUri });
@@ -574,13 +848,33 @@ var CognitoAuthClient = class extends TypedEventEmitter {
   async verifyTotpChallenge(challengeSession, code) {
     const cognitoUser = this._takeChallengeUser(challengeSession);
     return new Promise((resolve, reject) => {
-      cognitoUser.verifySoftwareToken(code, this.config.totpIssuer, {
+      cognitoUser.verifySoftwareToken(code, this._resolveTotpIssuer(), {
         onSuccess: (session) => resolve(this._onAuthSuccess(cognitoUser, session)),
         onFailure: (err) => reject(mapCognitoError(err))
       });
     });
   }
   // ─── Private helpers ───────────────────────────────────────────────────────
+  _requireFederatedConfig() {
+    if (!this.config.federated) {
+      throw new CognitoAuthError(
+        "Login federato non configurato \u2014 imposta AuthConfig.federated (domain, redirectUri)",
+        "INVALID_PARAMETER"
+      );
+    }
+    return this.config.federated;
+  }
+  _requireDeviceTracking() {
+    if (!this.config.deviceTracking) {
+      throw new CognitoAuthError(
+        "Device tracking non abilitato \u2014 imposta AuthConfig.deviceTracking: true",
+        "INVALID_PARAMETER"
+      );
+    }
+  }
+  _resolveTotpIssuer() {
+    return typeof this.config.totpIssuer === "function" ? this.config.totpIssuer() : this.config.totpIssuer;
+  }
   _getIdpClient() {
     if (!this._idpClient) {
       this._idpClient = new CognitoIdentityProviderClient({ region: this.config.region });
@@ -679,5 +973,5 @@ var CognitoAuthClient = class extends TypedEventEmitter {
 };
 
 export { AutoStorageAdapter, CognitoAuthClient, CognitoAuthError, InMemoryStorageAdapter, InvalidCodeError, LocalStorageAdapter, NotAuthorizedError, SessionExpiredError, SessionStorageAdapter, TypedEventEmitter, UserNotConfirmedError, mapCognitoError };
-//# sourceMappingURL=chunk-DKPFVGTY.js.map
-//# sourceMappingURL=chunk-DKPFVGTY.js.map
+//# sourceMappingURL=chunk-GNMHM6IU.js.map
+//# sourceMappingURL=chunk-GNMHM6IU.js.map