@massimo.mazzoleni/cognito-max 1.0.0

package/src/core/client.ts

@@ -0,0 +1,604 @@
+import {
+  AuthenticationDetails,
+  CognitoRefreshToken,
+  CognitoUser,
+  CognitoUserAttribute,
+  CognitoUserPool,
+  CognitoUserSession,
+} from 'amazon-cognito-identity-js'
+import {
+  CognitoIdentityProviderClient,
+  GetUserCommand,
+} from '@aws-sdk/client-cognito-identity-provider'
+
+import { TypedEventEmitter } from './event-bus'
+import { mapCognitoError, CognitoAuthError, SessionExpiredError } from './errors'
+import { AutoStorageAdapter } from './storage'
+import { buildAuthSession, buildAuthUser } from './internal/converters'
+import type {
+  AuthConfig,
+  AuthEvents,
+  AuthSession,
+  AuthState,
+  AuthUser,
+  MfaPreference,
+  MfaSetupResult,
+  MfaType,
+  ResolvedAuthConfig,
+  SignInResult,
+} from './types'
+
+function validateConfig(config: AuthConfig): void {
+  const missing = (['userPoolId', 'clientId', 'region'] as const).filter(k => !config[k])
+  if (missing.length) {
+    throw new CognitoAuthError(
+      `AuthConfig incompleto — campi obbligatori mancanti: ${missing.join(', ')}`,
+      'INVALID_PARAMETER',
+    )
+  }
+  if (!/^[a-z]{2}-[a-z]+-\d$/.test(config.region)) {
+    throw new CognitoAuthError(
+      `AuthConfig.region non valido: "${config.region}" (es. eu-west-1)`,
+      'INVALID_PARAMETER',
+    )
+  }
+}
+
+
+export class CognitoAuthClient extends TypedEventEmitter<AuthEvents> {
+  protected readonly config: ResolvedAuthConfig
+  private _state: AuthState = 'idle'
+  private readonly _pool: CognitoUserPool
+  private _idpClient: CognitoIdentityProviderClient | null = null
+  // Mappa challengeSession-id → CognitoUser in-flight (MFA / new-password challenge)
+  private readonly _pendingChallenges = new Map<string, CognitoUser>()
+  private _refreshTimer: ReturnType<typeof setTimeout> | null = null
+
+  constructor(config: AuthConfig) {
+    super()
+    validateConfig(config)
+    this.config = {
+      autoRefresh: true,
+      refreshMarginSeconds: 300,
+      totpIssuer: config.clientId,
+      storage: new AutoStorageAdapter(),
+      ...config,
+    }
+    this._pool = new CognitoUserPool({
+      UserPoolId: this.config.userPoolId,
+      ClientId: this.config.clientId,
+      // amazon-cognito-identity-js ICognitoStorage coincide con il nostro StorageAdapter
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      Storage: this.config.storage as any,
+    })
+  }
+
+  // ─── State ─────────────────────────────────────────────────────────────────
+
+  get state(): AuthState {
+    return this._state
+  }
+
+  protected setState(next: AuthState): void {
+    if (this._state === next) return
+    this._state = next
+    this.emit('stateChanged', next)
+  }
+
+  // ─── Sign-in ───────────────────────────────────────────────────────────────
+
+  async signIn(email: string, password: string): Promise<SignInResult> {
+    this.setState('loading')
+    const cognitoUser = this._makeCognitoUser(email)
+    const authDetails = new AuthenticationDetails({ Username: email, Password: password })
+
+    return new Promise<SignInResult>((resolve, reject) => {
+      cognitoUser.authenticateUser(authDetails, {
+        onSuccess: (session) => {
+          resolve(this._onAuthSuccess(cognitoUser, session))
+        },
+        onFailure: (err) => {
+          this.setState('unauthenticated')
+          reject(mapCognitoError(err))
+        },
+        mfaRequired: () => {
+          this.setState('mfa_required')
+          const challengeSession = this._storeChallengeUser(cognitoUser)
+          const result: SignInResult = { status: 'MFA_REQUIRED', mfaType: 'SMS', challengeSession }
+          this.emit('mfaRequired', { mfaType: 'SMS', challengeSession })
+          resolve(result)
+        },
+        totpRequired: () => {
+          this.setState('mfa_required')
+          const challengeSession = this._storeChallengeUser(cognitoUser)
+          const result: SignInResult = { status: 'MFA_REQUIRED', mfaType: 'TOTP', challengeSession }
+          this.emit('mfaRequired', { mfaType: 'TOTP', challengeSession })
+          resolve(result)
+        },
+        newPasswordRequired: (_userAttributes, requiredAttributes) => {
+          this.setState('new_password_required')
+          const challengeSession = this._storeChallengeUser(cognitoUser)
+          const required: string[] = Array.isArray(requiredAttributes) ? requiredAttributes : []
+          this.emit('newPasswordRequired', { requiredAttributes: required, challengeSession })
+          resolve({ status: 'NEW_PASSWORD_REQUIRED', requiredAttributes: required, challengeSession })
+        },
+        // Cognito richiede il setup TOTP prima di completare il login
+        mfaSetup: () => {
+          this.setState('mfa_required')
+          const challengeSession = this._storeChallengeUser(cognitoUser)
+          resolve({ status: 'MFA_SETUP_REQUIRED', challengeSession })
+        },
+      })
+    })
+  }
+
+  async respondToMfaChallenge(
+    challengeSession: string,
+    code: string,
+    mfaType: MfaType,
+  ): Promise<SignInResult> {
+    const cognitoUser = this._takeChallengeUser(challengeSession)
+    const sdkType = mfaType === 'TOTP' ? 'SOFTWARE_TOKEN_MFA' : 'SMS_MFA'
+
+    return new Promise<SignInResult>((resolve, reject) => {
+      cognitoUser.sendMFACode(
+        code,
+        {
+          onSuccess: (session) => resolve(this._onAuthSuccess(cognitoUser, session)),
+          onFailure: (err) => {
+            this.setState('unauthenticated')
+            reject(mapCognitoError(err))
+          },
+        },
+        sdkType,
+      )
+    })
+  }
+
+  async respondToNewPasswordChallenge(
+    challengeSession: string,
+    newPassword: string,
+    userAttributes?: Record<string, string>,
+  ): Promise<SignInResult> {
+    const cognitoUser = this._takeChallengeUser(challengeSession)
+
+    return new Promise<SignInResult>((resolve, reject) => {
+      cognitoUser.completeNewPasswordChallenge(
+        newPassword,
+        userAttributes ?? {}, // es. { name, family_name, given_name }
+        {
+          onSuccess: (session) => resolve(this._onAuthSuccess(cognitoUser, session)),
+          onFailure: (err) => {
+            this.setState('unauthenticated')
+            reject(mapCognitoError(err))
+          },
+          // Cognito può richiedere MFA anche dopo il cambio password forzato
+          mfaRequired: () => {
+            this.setState('mfa_required')
+            const newSession = this._storeChallengeUser(cognitoUser)
+            this.emit('mfaRequired', { mfaType: 'SMS', challengeSession: newSession })
+            resolve({ status: 'MFA_REQUIRED', mfaType: 'SMS', challengeSession: newSession })
+          },
+          totpRequired: () => {
+            this.setState('mfa_required')
+            const newSession = this._storeChallengeUser(cognitoUser)
+            this.emit('mfaRequired', { mfaType: 'TOTP', challengeSession: newSession })
+            resolve({ status: 'MFA_REQUIRED', mfaType: 'TOTP', challengeSession: newSession })
+          },
+        },
+      )
+    })
+  }
+
+  async signOut(global = false): Promise<void> {
+    this._clearRefreshTimer()
+    this._pendingChallenges.clear()
+
+    const cognitoUser = this._pool.getCurrentUser()
+    if (!cognitoUser) {
+      this.setState('unauthenticated')
+      this.emit('signedOut')
+      return
+    }
+
+    if (global) {
+      await new Promise<void>((resolve, reject) => {
+        cognitoUser.globalSignOut({
+          onSuccess: () => {
+            this.setState('unauthenticated')
+            this.emit('signedOut')
+            resolve()
+          },
+          onFailure: (err) => reject(mapCognitoError(err)),
+        })
+      })
+    } else {
+      cognitoUser.signOut()
+      this.setState('unauthenticated')
+      this.emit('signedOut')
+    }
+  }
+
+  // ─── Registration ──────────────────────────────────────────────────────────
+
+  async signUp(
+    email: string,
+    password: string,
+    attributes: Record<string, string> = {},
+  ): Promise<void> {
+    const userAttributes = Object.entries({ email, ...attributes }).map(
+      ([Name, Value]) => new CognitoUserAttribute({ Name, Value }),
+    )
+
+    await new Promise<void>((resolve, reject) => {
+      this._pool.signUp(email, password, userAttributes, [], (err) => {
+        if (err) return reject(mapCognitoError(err))
+        resolve()
+      })
+    })
+  }
+
+  async confirmSignUp(email: string, code: string): Promise<void> {
+    const cognitoUser = this._makeCognitoUser(email)
+    await new Promise<void>((resolve, reject) => {
+      cognitoUser.confirmRegistration(code, true, (err) => {
+        if (err) return reject(mapCognitoError(err))
+        resolve()
+      })
+    })
+  }
+
+  async resendConfirmationCode(email: string): Promise<void> {
+    const cognitoUser = this._makeCognitoUser(email)
+    await new Promise<void>((resolve, reject) => {
+      cognitoUser.resendConfirmationCode((err) => {
+        if (err) return reject(mapCognitoError(err))
+        resolve()
+      })
+    })
+  }
+
+  // ─── Password ──────────────────────────────────────────────────────────────
+
+  async forgotPassword(email: string): Promise<void> {
+    const cognitoUser = this._makeCognitoUser(email)
+    await new Promise<void>((resolve, reject) => {
+      cognitoUser.forgotPassword({
+        // inputVerificationCode → il codice è stato inviato all'email/telefono
+        inputVerificationCode: () => resolve(),
+        onSuccess: () => resolve(),
+        onFailure: (err) => reject(mapCognitoError(err)),
+      })
+    })
+  }
+
+  async confirmForgotPassword(
+    email: string,
+    code: string,
+    newPassword: string,
+  ): Promise<void> {
+    const cognitoUser = this._makeCognitoUser(email)
+    await new Promise<void>((resolve, reject) => {
+      cognitoUser.confirmPassword(code, newPassword, {
+        onSuccess: () => resolve(),
+        onFailure: (err) => reject(mapCognitoError(err)),
+      })
+    })
+  }
+
+  async changePassword(currentPassword: string, newPassword: string): Promise<void> {
+    const cognitoUser = await this._getAuthenticatedUser()
+    await new Promise<void>((resolve, reject) => {
+      cognitoUser.changePassword(currentPassword, newPassword, (err) => {
+        if (err) return reject(mapCognitoError(err))
+        resolve()
+      })
+    })
+  }
+
+  // ─── Session & User ────────────────────────────────────────────────────────
+
+  async getSession(): Promise<AuthSession> {
+    const cognitoUser = this._pool.getCurrentUser()
+    if (!cognitoUser) throw new SessionExpiredError()
+
+    const raw = await this._getRawSession(cognitoUser)
+    this._scheduleRefresh(cognitoUser, raw)
+    return buildAuthSession(raw)
+  }
+
+  async getCurrentUser(): Promise<AuthUser | null> {
+    const cognitoUser = this._pool.getCurrentUser()
+    if (!cognitoUser) return null
+
+    try {
+      const session = await this._getRawSession(cognitoUser)
+      this.setState('authenticated')
+      return buildAuthUser(session, cognitoUser.getUsername())
+    } catch {
+      return null
+    }
+  }
+
+  async getUserAttributes(): Promise<Record<string, string>> {
+    const cognitoUser = await this._getAuthenticatedUser()
+    return new Promise((resolve, reject) => {
+      cognitoUser.getUserAttributes((err, result) => {
+        if (err) return reject(mapCognitoError(err))
+        resolve(Object.fromEntries((result ?? []).map(a => [a.getName(), a.getValue()])))
+      })
+    })
+  }
+
+  async updateUserAttributes(attributes: Record<string, string>): Promise<void> {
+    const cognitoUser = await this._getAuthenticatedUser()
+    const attrs = Object.entries(attributes).map(
+      ([Name, Value]) => new CognitoUserAttribute({ Name, Value }),
+    )
+    await new Promise<void>((resolve, reject) => {
+      cognitoUser.updateAttributes(attrs, (err) => {
+        if (err) return reject(mapCognitoError(err))
+        resolve()
+      })
+    })
+  }
+
+  async verifyUserAttribute(
+    attribute: 'email' | 'phone_number',
+    code: string,
+  ): Promise<void> {
+    const cognitoUser = await this._getAuthenticatedUser()
+    await new Promise<void>((resolve, reject) => {
+      cognitoUser.verifyAttribute(attribute, code, {
+        onSuccess: () => resolve(),
+        onFailure: (err) => reject(mapCognitoError(err)),
+      })
+    })
+  }
+
+  async sendAttributeVerificationCode(attribute: 'email' | 'phone_number'): Promise<void> {
+    const cognitoUser = await this._getAuthenticatedUser()
+    await new Promise<void>((resolve, reject) => {
+      cognitoUser.getAttributeVerificationCode(attribute, {
+        onSuccess: () => resolve(),
+        onFailure: (err) => reject(mapCognitoError(err)),
+        inputVerificationCode: () => resolve(),
+      })
+    })
+  }
+
+  async deleteUser(): Promise<void> {
+    const cognitoUser = await this._getAuthenticatedUser()
+    this._clearRefreshTimer()
+    await new Promise<void>((resolve, reject) => {
+      cognitoUser.deleteUser((err) => {
+        if (err) return reject(mapCognitoError(err))
+        this.setState('unauthenticated')
+        this.emit('signedOut')
+        resolve()
+      })
+    })
+  }
+
+  // ─── MFA ───────────────────────────────────────────────────────────────────
+
+  async setupTotp(): Promise<MfaSetupResult> {
+    const cognitoUser = await this._getAuthenticatedUser()
+    return new Promise<MfaSetupResult>((resolve, reject) => {
+      cognitoUser.associateSoftwareToken({
+        associateSecretCode: (secretCode: string) => {
+          const issuer = encodeURIComponent(this.config.totpIssuer)
+          const account = encodeURIComponent(cognitoUser.getUsername())
+          const qrCodeUri =
+            `otpauth://totp/${issuer}:${account}` +
+            `?secret=${secretCode}&issuer=${issuer}`
+          resolve({ secretCode, qrCodeUri })
+        },
+        onFailure: (err: Error) => reject(mapCognitoError(err)),
+      })
+    })
+  }
+
+  async verifyTotpSetup(code: string): Promise<void> {
+    const cognitoUser = await this._getAuthenticatedUser()
+    return new Promise<void>((resolve, reject) => {
+      cognitoUser.verifySoftwareToken(code, this.config.totpIssuer, {
+        onSuccess: () => resolve(),
+        onFailure: (err: Error) => reject(mapCognitoError(err)),
+      })
+    })
+  }
+
+  async getMfaPreference(): Promise<MfaPreference> {
+    const session = await this.getSession()
+    try {
+      const response = await this._getIdpClient().send(
+        new GetUserCommand({ AccessToken: session.accessToken }),
+      )
+      const enabled: string[] = response.UserMFASettingList ?? []
+      const preferred: string | null = response.PreferredMfaSetting ?? null
+      const toSdkType = (s: string | null): MfaType | null =>
+        s === 'SOFTWARE_TOKEN_MFA' ? 'TOTP' : s === 'SMS_MFA' ? 'SMS' : null
+      return {
+        enabled: enabled.length > 0,
+        preferred: toSdkType(preferred),
+        totp: enabled.includes('SOFTWARE_TOKEN_MFA'),
+        sms: enabled.includes('SMS_MFA'),
+      }
+    } catch (err) {
+      throw mapCognitoError(err)
+    }
+  }
+
+  async setMfaPreference(type: MfaType): Promise<void> {
+    const cognitoUser = await this._getAuthenticatedUser()
+    const smsMfa = { Enabled: type === 'SMS', PreferredMfa: type === 'SMS' }
+    const totpMfa = { Enabled: type === 'TOTP', PreferredMfa: type === 'TOTP' }
+    return new Promise<void>((resolve, reject) => {
+      cognitoUser.setUserMfaPreference(smsMfa, totpMfa, (err: Error | undefined) => {
+        if (err) return reject(mapCognitoError(err))
+        resolve()
+      })
+    })
+  }
+
+  async disableMfa(): Promise<void> {
+    const cognitoUser = await this._getAuthenticatedUser()
+    const off = { Enabled: false, PreferredMfa: false }
+    return new Promise<void>((resolve, reject) => {
+      cognitoUser.setUserMfaPreference(off, off, (err: Error | undefined) => {
+        if (err) return reject(mapCognitoError(err))
+        resolve()
+      })
+    })
+  }
+
+  // ─── TOTP setup durante il challenge login ─────────────────────────────────
+
+  /**
+   * Ottiene il secretCode/QR URI per il setup TOTP durante il flusso di login
+   * (quando signIn restituisce MFA_SETUP_REQUIRED). Non richiede una sessione
+   * autenticata: usa il CognitoUser in attesa nel challenge.
+   */
+  async setupTotpChallenge(challengeSession: string): Promise<MfaSetupResult> {
+    const cognitoUser = this._peekChallengeUser(challengeSession)
+    return new Promise<MfaSetupResult>((resolve, reject) => {
+      cognitoUser.associateSoftwareToken({
+        associateSecretCode: (secretCode: string) => {
+          const issuer = encodeURIComponent(this.config.totpIssuer)
+          const account = encodeURIComponent(cognitoUser.getUsername())
+          const qrCodeUri =
+            `otpauth://totp/${issuer}:${account}` +
+            `?secret=${secretCode}&issuer=${issuer}`
+          resolve({ secretCode, qrCodeUri })
+        },
+        onFailure: (err: Error) => reject(mapCognitoError(err)),
+      })
+    })
+  }
+
+  /**
+   * Verifica il codice TOTP e completa il login. Dopo questa chiamata la
+   * sessione è autenticata e il challenge viene rimosso dalla mappa.
+   */
+  async verifyTotpChallenge(challengeSession: string, code: string): Promise<SignInResult> {
+    const cognitoUser = this._takeChallengeUser(challengeSession)
+    return new Promise<SignInResult>((resolve, reject) => {
+      cognitoUser.verifySoftwareToken(code, this.config.totpIssuer, {
+        onSuccess: (session: CognitoUserSession) => resolve(this._onAuthSuccess(cognitoUser, session)),
+        onFailure: (err: Error) => reject(mapCognitoError(err)),
+      })
+    })
+  }
+
+  // ─── Private helpers ───────────────────────────────────────────────────────
+
+  private _getIdpClient(): CognitoIdentityProviderClient {
+    if (!this._idpClient) {
+      this._idpClient = new CognitoIdentityProviderClient({ region: this.config.region })
+    }
+    return this._idpClient
+  }
+
+  private _makeCognitoUser(username: string): CognitoUser {
+    return new CognitoUser({
+      Username: username,
+      Pool: this._pool,
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      Storage: this.config.storage as any,
+    })
+  }
+
+  private _storeChallengeUser(cognitoUser: CognitoUser): string {
+    const id = crypto.randomUUID()
+    this._pendingChallenges.set(id, cognitoUser)
+    return id
+  }
+
+  private _takeChallengeUser(challengeSession: string): CognitoUser {
+    const user = this._pendingChallenges.get(challengeSession)
+    if (!user) {
+      throw new CognitoAuthError(
+        'Challenge session non valida o scaduta',
+        'UNKNOWN',
+      )
+    }
+    this._pendingChallenges.delete(challengeSession)
+    return user
+  }
+
+  /** Legge il CognitoUser senza rimuoverlo dalla mappa (per setupTotpChallenge). */
+  private _peekChallengeUser(challengeSession: string): CognitoUser {
+    const user = this._pendingChallenges.get(challengeSession)
+    if (!user) {
+      throw new CognitoAuthError(
+        'Challenge session non valida o scaduta',
+        'UNKNOWN',
+      )
+    }
+    return user
+  }
+
+  private _onAuthSuccess(cognitoUser: CognitoUser, session: CognitoUserSession): SignInResult {
+    const authSession = buildAuthSession(session)
+    const authUser = buildAuthUser(session, cognitoUser.getUsername())
+    this.setState('authenticated')
+    this.emit('signedIn', authUser)
+    this._scheduleRefresh(cognitoUser, session)
+    return { status: 'SUCCESS', user: authUser, session: authSession }
+  }
+
+  private _getRawSession(cognitoUser: CognitoUser): Promise<CognitoUserSession> {
+    return new Promise((resolve, reject) => {
+      cognitoUser.getSession((err: Error | null, session: CognitoUserSession | null) => {
+        if (err || !session) {
+          return reject(err ? mapCognitoError(err) : new SessionExpiredError())
+        }
+        if (!session.isValid()) {
+          return reject(new SessionExpiredError())
+        }
+        resolve(session)
+      })
+    })
+  }
+
+  private async _getAuthenticatedUser(): Promise<CognitoUser> {
+    const cognitoUser = this._pool.getCurrentUser()
+    if (!cognitoUser) throw new SessionExpiredError()
+    // getSession gestisce internamente il refresh se il token è scaduto
+    await this._getRawSession(cognitoUser)
+    return cognitoUser
+  }
+
+  private _scheduleRefresh(cognitoUser: CognitoUser, session: CognitoUserSession): void {
+    if (!this.config.autoRefresh) return
+    this._clearRefreshTimer()
+
+    const expiresAt = session.getAccessToken().getExpiration() * 1000
+    const refreshIn = expiresAt - Date.now() - this.config.refreshMarginSeconds * 1000
+
+    if (refreshIn <= 0) return
+
+    this._refreshTimer = setTimeout(() => {
+      const refreshToken = new CognitoRefreshToken({
+        RefreshToken: session.getRefreshToken().getToken(),
+      })
+      cognitoUser.refreshSession(refreshToken, (err, newSession: CognitoUserSession) => {
+        if (err) {
+          this.emit('sessionExpired')
+          this.setState('unauthenticated')
+          return
+        }
+        this.emit('tokenRefreshed', buildAuthSession(newSession))
+        this._scheduleRefresh(cognitoUser, newSession)
+      })
+    }, refreshIn)
+  }
+
+  private _clearRefreshTimer(): void {
+    if (this._refreshTimer !== null) {
+      clearTimeout(this._refreshTimer)
+      this._refreshTimer = null
+    }
+  }
+}

package/src/core/errors.ts

@@ -0,0 +1,91 @@
+export type AuthErrorCode =
+  | 'NOT_AUTHORIZED'
+  | 'USER_NOT_FOUND'
+  | 'USER_NOT_CONFIRMED'
+  | 'INVALID_PARAMETER'
+  | 'INVALID_PASSWORD'
+  | 'CODE_MISMATCH'
+  | 'EXPIRED_CODE'
+  | 'CODE_DELIVERY_FAILURE'
+  | 'LIMIT_EXCEEDED'
+  | 'TOO_MANY_REQUESTS'
+  | 'TOO_MANY_FAILED_ATTEMPTS'
+  | 'PASSWORD_RESET_REQUIRED'
+  | 'MFA_METHOD_NOT_FOUND'
+  | 'SOFTWARE_TOKEN_MFA_NOT_FOUND'
+  | 'SESSION_EXPIRED'
+  | 'NETWORK_ERROR'
+  | 'UNKNOWN'
+
+export class CognitoAuthError extends Error {
+  override readonly name = 'CognitoAuthError'
+
+  constructor(
+    message: string,
+    public readonly code: AuthErrorCode,
+    public readonly originalError?: unknown,
+  ) {
+    super(message)
+    Object.setPrototypeOf(this, new.target.prototype)
+  }
+}
+
+export class SessionExpiredError extends CognitoAuthError {
+  constructor() {
+    super('La sessione è scaduta, effettua nuovamente il login', 'SESSION_EXPIRED')
+    Object.setPrototypeOf(this, new.target.prototype)
+  }
+}
+
+export class NotAuthorizedError extends CognitoAuthError {
+  constructor(message = 'Credenziali non valide') {
+    super(message, 'NOT_AUTHORIZED')
+    Object.setPrototypeOf(this, new.target.prototype)
+  }
+}
+
+export class UserNotConfirmedError extends CognitoAuthError {
+  constructor() {
+    super('Account non confermato. Controlla la tua email.', 'USER_NOT_CONFIRMED')
+    Object.setPrototypeOf(this, new.target.prototype)
+  }
+}
+
+export class InvalidCodeError extends CognitoAuthError {
+  constructor(expired = false) {
+    super(
+      expired ? 'Il codice è scaduto' : 'Codice non valido',
+      expired ? 'EXPIRED_CODE' : 'CODE_MISMATCH',
+    )
+    Object.setPrototypeOf(this, new.target.prototype)
+  }
+}
+
+// Maps raw Cognito SDK error names to our typed errors
+export function mapCognitoError(error: unknown): CognitoAuthError {
+  if (error instanceof CognitoAuthError) return error
+
+  const name: string = (error as any)?.name ?? (error as any)?.code ?? ''
+  const message: string = (error as any)?.message ?? 'Si è verificato un errore di autenticazione'
+
+  const codeMap: Record<string, AuthErrorCode> = {
+    NotAuthorizedException: 'NOT_AUTHORIZED',
+    UserNotFoundException: 'USER_NOT_FOUND',
+    UserNotConfirmedException: 'USER_NOT_CONFIRMED',
+    InvalidParameterException: 'INVALID_PARAMETER',
+    InvalidPasswordException: 'INVALID_PASSWORD',
+    CodeMismatchException: 'CODE_MISMATCH',
+    ExpiredCodeException: 'EXPIRED_CODE',
+    CodeDeliveryFailureException: 'CODE_DELIVERY_FAILURE',
+    LimitExceededException: 'LIMIT_EXCEEDED',
+    TooManyRequestsException: 'TOO_MANY_REQUESTS',
+    TooManyFailedAttemptsException: 'TOO_MANY_FAILED_ATTEMPTS',
+    PasswordResetRequiredException: 'PASSWORD_RESET_REQUIRED',
+    MFAMethodNotFoundException: 'MFA_METHOD_NOT_FOUND',
+    SoftwareTokenMFANotFoundException: 'SOFTWARE_TOKEN_MFA_NOT_FOUND',
+    NetworkError: 'NETWORK_ERROR',
+    FetchError: 'NETWORK_ERROR',
+  }
+
+  return new CognitoAuthError(message, codeMap[name] ?? 'UNKNOWN', error)
+}