@massimo.mazzoleni/cognito-max 1.0.0

package/dist/index.cjs

@@ -0,0 +1,696 @@
+'use strict';
+
+var amazonCognitoIdentityJs = require('amazon-cognito-identity-js');
+var clientCognitoIdentityProvider = require('@aws-sdk/client-cognito-identity-provider');
+
+// src/core/errors.ts
+var CognitoAuthError = class extends Error {
+  constructor(message, code, originalError) {
+    super(message);
+    this.code = code;
+    this.originalError = originalError;
+    this.name = "CognitoAuthError";
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var SessionExpiredError = class extends CognitoAuthError {
+  constructor() {
+    super("La sessione \xE8 scaduta, effettua nuovamente il login", "SESSION_EXPIRED");
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var NotAuthorizedError = class extends CognitoAuthError {
+  constructor(message = "Credenziali non valide") {
+    super(message, "NOT_AUTHORIZED");
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var UserNotConfirmedError = class extends CognitoAuthError {
+  constructor() {
+    super("Account non confermato. Controlla la tua email.", "USER_NOT_CONFIRMED");
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var InvalidCodeError = class extends CognitoAuthError {
+  constructor(expired = false) {
+    super(
+      expired ? "Il codice \xE8 scaduto" : "Codice non valido",
+      expired ? "EXPIRED_CODE" : "CODE_MISMATCH"
+    );
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+function mapCognitoError(error) {
+  if (error instanceof CognitoAuthError) return error;
+  const name = error?.name ?? error?.code ?? "";
+  const message = error?.message ?? "Si \xE8 verificato un errore di autenticazione";
+  const codeMap = {
+    NotAuthorizedException: "NOT_AUTHORIZED",
+    UserNotFoundException: "USER_NOT_FOUND",
+    UserNotConfirmedException: "USER_NOT_CONFIRMED",
+    InvalidParameterException: "INVALID_PARAMETER",
+    InvalidPasswordException: "INVALID_PASSWORD",
+    CodeMismatchException: "CODE_MISMATCH",
+    ExpiredCodeException: "EXPIRED_CODE",
+    CodeDeliveryFailureException: "CODE_DELIVERY_FAILURE",
+    LimitExceededException: "LIMIT_EXCEEDED",
+    TooManyRequestsException: "TOO_MANY_REQUESTS",
+    TooManyFailedAttemptsException: "TOO_MANY_FAILED_ATTEMPTS",
+    PasswordResetRequiredException: "PASSWORD_RESET_REQUIRED",
+    MFAMethodNotFoundException: "MFA_METHOD_NOT_FOUND",
+    SoftwareTokenMFANotFoundException: "SOFTWARE_TOKEN_MFA_NOT_FOUND",
+    NetworkError: "NETWORK_ERROR",
+    FetchError: "NETWORK_ERROR"
+  };
+  return new CognitoAuthError(message, codeMap[name] ?? "UNKNOWN", error);
+}
+
+// src/core/storage.ts
+var LocalStorageAdapter = class {
+  getItem(key) {
+    return localStorage.getItem(key);
+  }
+  setItem(key, value) {
+    localStorage.setItem(key, value);
+  }
+  removeItem(key) {
+    localStorage.removeItem(key);
+  }
+  clear() {
+    localStorage.clear();
+  }
+};
+var SessionStorageAdapter = class {
+  getItem(key) {
+    return sessionStorage.getItem(key);
+  }
+  setItem(key, value) {
+    sessionStorage.setItem(key, value);
+  }
+  removeItem(key) {
+    sessionStorage.removeItem(key);
+  }
+  clear() {
+    sessionStorage.clear();
+  }
+};
+var InMemoryStorageAdapter = class {
+  constructor() {
+    this.store = /* @__PURE__ */ new Map();
+  }
+  getItem(key) {
+    return this.store.get(key) ?? null;
+  }
+  setItem(key, value) {
+    this.store.set(key, value);
+  }
+  removeItem(key) {
+    this.store.delete(key);
+  }
+  clear() {
+    this.store.clear();
+  }
+};
+var AutoStorageAdapter = class {
+  constructor() {
+    this.delegate = typeof window !== "undefined" && window.localStorage ? new LocalStorageAdapter() : new InMemoryStorageAdapter();
+  }
+  getItem(key) {
+    return this.delegate.getItem(key);
+  }
+  setItem(key, value) {
+    this.delegate.setItem(key, value);
+  }
+  removeItem(key) {
+    this.delegate.removeItem(key);
+  }
+  clear() {
+    this.delegate.clear?.();
+  }
+};
+
+// src/core/event-bus.ts
+var TypedEventEmitter = class {
+  constructor() {
+    this._listeners = /* @__PURE__ */ new Map();
+  }
+  on(event, listener) {
+    if (!this._listeners.has(event)) {
+      this._listeners.set(event, /* @__PURE__ */ new Set());
+    }
+    this._listeners.get(event).add(listener);
+    return () => this.off(event, listener);
+  }
+  off(event, listener) {
+    this._listeners.get(event)?.delete(listener);
+  }
+  once(event, listener) {
+    const unsub = this.on(event, ((...args) => {
+      unsub();
+      listener(...args);
+    }));
+    return unsub;
+  }
+  emit(event, ...args) {
+    this._listeners.get(event)?.forEach((l) => l(...args));
+  }
+  removeAllListeners(event) {
+    if (event !== void 0) {
+      this._listeners.delete(event);
+    } else {
+      this._listeners.clear();
+    }
+  }
+};
+
+// src/core/internal/converters.ts
+function buildAuthSession(session) {
+  const expiresAt = new Date(session.getAccessToken().getExpiration() * 1e3);
+  return {
+    accessToken: session.getAccessToken().getJwtToken(),
+    idToken: session.getIdToken().getJwtToken(),
+    refreshToken: session.getRefreshToken().getToken(),
+    expiresAt,
+    isValid: () => session.isValid()
+  };
+}
+function buildAuthUser(session, fallbackUsername) {
+  const payload = session.getIdToken().decodePayload();
+  const str = (v) => v != null ? String(v) : "";
+  const bool = (v) => v === true || v === "true";
+  return {
+    sub: str(payload["sub"]),
+    username: str(payload["cognito:username"] ?? fallbackUsername),
+    email: str(payload["email"]),
+    emailVerified: bool(payload["email_verified"]),
+    groups: Array.isArray(payload["cognito:groups"]) ? payload["cognito:groups"] : [],
+    attributes: Object.fromEntries(Object.entries(payload).map(([k, v]) => [k, str(v)]))
+  };
+}
+
+// src/core/client.ts
+function validateConfig(config) {
+  const missing = ["userPoolId", "clientId", "region"].filter((k) => !config[k]);
+  if (missing.length) {
+    throw new CognitoAuthError(
+      `AuthConfig incompleto \u2014 campi obbligatori mancanti: ${missing.join(", ")}`,
+      "INVALID_PARAMETER"
+    );
+  }
+  if (!/^[a-z]{2}-[a-z]+-\d$/.test(config.region)) {
+    throw new CognitoAuthError(
+      `AuthConfig.region non valido: "${config.region}" (es. eu-west-1)`,
+      "INVALID_PARAMETER"
+    );
+  }
+}
+var CognitoAuthClient = class extends TypedEventEmitter {
+  constructor(config) {
+    super();
+    this._state = "idle";
+    this._idpClient = null;
+    // Mappa challengeSession-id → CognitoUser in-flight (MFA / new-password challenge)
+    this._pendingChallenges = /* @__PURE__ */ new Map();
+    this._refreshTimer = null;
+    validateConfig(config);
+    this.config = {
+      autoRefresh: true,
+      refreshMarginSeconds: 300,
+      totpIssuer: config.clientId,
+      storage: new AutoStorageAdapter(),
+      ...config
+    };
+    this._pool = new amazonCognitoIdentityJs.CognitoUserPool({
+      UserPoolId: this.config.userPoolId,
+      ClientId: this.config.clientId,
+      // amazon-cognito-identity-js ICognitoStorage coincide con il nostro StorageAdapter
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      Storage: this.config.storage
+    });
+  }
+  // ─── State ─────────────────────────────────────────────────────────────────
+  get state() {
+    return this._state;
+  }
+  setState(next) {
+    if (this._state === next) return;
+    this._state = next;
+    this.emit("stateChanged", next);
+  }
+  // ─── Sign-in ───────────────────────────────────────────────────────────────
+  async signIn(email, password) {
+    this.setState("loading");
+    const cognitoUser = this._makeCognitoUser(email);
+    const authDetails = new amazonCognitoIdentityJs.AuthenticationDetails({ Username: email, Password: password });
+    return new Promise((resolve, reject) => {
+      cognitoUser.authenticateUser(authDetails, {
+        onSuccess: (session) => {
+          resolve(this._onAuthSuccess(cognitoUser, session));
+        },
+        onFailure: (err) => {
+          this.setState("unauthenticated");
+          reject(mapCognitoError(err));
+        },
+        mfaRequired: () => {
+          this.setState("mfa_required");
+          const challengeSession = this._storeChallengeUser(cognitoUser);
+          const result = { status: "MFA_REQUIRED", mfaType: "SMS", challengeSession };
+          this.emit("mfaRequired", { mfaType: "SMS", challengeSession });
+          resolve(result);
+        },
+        totpRequired: () => {
+          this.setState("mfa_required");
+          const challengeSession = this._storeChallengeUser(cognitoUser);
+          const result = { status: "MFA_REQUIRED", mfaType: "TOTP", challengeSession };
+          this.emit("mfaRequired", { mfaType: "TOTP", challengeSession });
+          resolve(result);
+        },
+        newPasswordRequired: (_userAttributes, requiredAttributes) => {
+          this.setState("new_password_required");
+          const challengeSession = this._storeChallengeUser(cognitoUser);
+          const required = Array.isArray(requiredAttributes) ? requiredAttributes : [];
+          this.emit("newPasswordRequired", { requiredAttributes: required, challengeSession });
+          resolve({ status: "NEW_PASSWORD_REQUIRED", requiredAttributes: required, challengeSession });
+        },
+        // Cognito richiede il setup TOTP prima di completare il login
+        mfaSetup: () => {
+          this.setState("mfa_required");
+          const challengeSession = this._storeChallengeUser(cognitoUser);
+          resolve({ status: "MFA_SETUP_REQUIRED", challengeSession });
+        }
+      });
+    });
+  }
+  async respondToMfaChallenge(challengeSession, code, mfaType) {
+    const cognitoUser = this._takeChallengeUser(challengeSession);
+    const sdkType = mfaType === "TOTP" ? "SOFTWARE_TOKEN_MFA" : "SMS_MFA";
+    return new Promise((resolve, reject) => {
+      cognitoUser.sendMFACode(
+        code,
+        {
+          onSuccess: (session) => resolve(this._onAuthSuccess(cognitoUser, session)),
+          onFailure: (err) => {
+            this.setState("unauthenticated");
+            reject(mapCognitoError(err));
+          }
+        },
+        sdkType
+      );
+    });
+  }
+  async respondToNewPasswordChallenge(challengeSession, newPassword, userAttributes) {
+    const cognitoUser = this._takeChallengeUser(challengeSession);
+    return new Promise((resolve, reject) => {
+      cognitoUser.completeNewPasswordChallenge(
+        newPassword,
+        userAttributes ?? {},
+        // es. { name, family_name, given_name }
+        {
+          onSuccess: (session) => resolve(this._onAuthSuccess(cognitoUser, session)),
+          onFailure: (err) => {
+            this.setState("unauthenticated");
+            reject(mapCognitoError(err));
+          },
+          // Cognito può richiedere MFA anche dopo il cambio password forzato
+          mfaRequired: () => {
+            this.setState("mfa_required");
+            const newSession = this._storeChallengeUser(cognitoUser);
+            this.emit("mfaRequired", { mfaType: "SMS", challengeSession: newSession });
+            resolve({ status: "MFA_REQUIRED", mfaType: "SMS", challengeSession: newSession });
+          },
+          totpRequired: () => {
+            this.setState("mfa_required");
+            const newSession = this._storeChallengeUser(cognitoUser);
+            this.emit("mfaRequired", { mfaType: "TOTP", challengeSession: newSession });
+            resolve({ status: "MFA_REQUIRED", mfaType: "TOTP", challengeSession: newSession });
+          }
+        }
+      );
+    });
+  }
+  async signOut(global = false) {
+    this._clearRefreshTimer();
+    this._pendingChallenges.clear();
+    const cognitoUser = this._pool.getCurrentUser();
+    if (!cognitoUser) {
+      this.setState("unauthenticated");
+      this.emit("signedOut");
+      return;
+    }
+    if (global) {
+      await new Promise((resolve, reject) => {
+        cognitoUser.globalSignOut({
+          onSuccess: () => {
+            this.setState("unauthenticated");
+            this.emit("signedOut");
+            resolve();
+          },
+          onFailure: (err) => reject(mapCognitoError(err))
+        });
+      });
+    } else {
+      cognitoUser.signOut();
+      this.setState("unauthenticated");
+      this.emit("signedOut");
+    }
+  }
+  // ─── Registration ──────────────────────────────────────────────────────────
+  async signUp(email, password, attributes = {}) {
+    const userAttributes = Object.entries({ email, ...attributes }).map(
+      ([Name, Value]) => new amazonCognitoIdentityJs.CognitoUserAttribute({ Name, Value })
+    );
+    await new Promise((resolve, reject) => {
+      this._pool.signUp(email, password, userAttributes, [], (err) => {
+        if (err) return reject(mapCognitoError(err));
+        resolve();
+      });
+    });
+  }
+  async confirmSignUp(email, code) {
+    const cognitoUser = this._makeCognitoUser(email);
+    await new Promise((resolve, reject) => {
+      cognitoUser.confirmRegistration(code, true, (err) => {
+        if (err) return reject(mapCognitoError(err));
+        resolve();
+      });
+    });
+  }
+  async resendConfirmationCode(email) {
+    const cognitoUser = this._makeCognitoUser(email);
+    await new Promise((resolve, reject) => {
+      cognitoUser.resendConfirmationCode((err) => {
+        if (err) return reject(mapCognitoError(err));
+        resolve();
+      });
+    });
+  }
+  // ─── Password ──────────────────────────────────────────────────────────────
+  async forgotPassword(email) {
+    const cognitoUser = this._makeCognitoUser(email);
+    await new Promise((resolve, reject) => {
+      cognitoUser.forgotPassword({
+        // inputVerificationCode → il codice è stato inviato all'email/telefono
+        inputVerificationCode: () => resolve(),
+        onSuccess: () => resolve(),
+        onFailure: (err) => reject(mapCognitoError(err))
+      });
+    });
+  }
+  async confirmForgotPassword(email, code, newPassword) {
+    const cognitoUser = this._makeCognitoUser(email);
+    await new Promise((resolve, reject) => {
+      cognitoUser.confirmPassword(code, newPassword, {
+        onSuccess: () => resolve(),
+        onFailure: (err) => reject(mapCognitoError(err))
+      });
+    });
+  }
+  async changePassword(currentPassword, newPassword) {
+    const cognitoUser = await this._getAuthenticatedUser();
+    await new Promise((resolve, reject) => {
+      cognitoUser.changePassword(currentPassword, newPassword, (err) => {
+        if (err) return reject(mapCognitoError(err));
+        resolve();
+      });
+    });
+  }
+  // ─── Session & User ────────────────────────────────────────────────────────
+  async getSession() {
+    const cognitoUser = this._pool.getCurrentUser();
+    if (!cognitoUser) throw new SessionExpiredError();
+    const raw = await this._getRawSession(cognitoUser);
+    this._scheduleRefresh(cognitoUser, raw);
+    return buildAuthSession(raw);
+  }
+  async getCurrentUser() {
+    const cognitoUser = this._pool.getCurrentUser();
+    if (!cognitoUser) return null;
+    try {
+      const session = await this._getRawSession(cognitoUser);
+      this.setState("authenticated");
+      return buildAuthUser(session, cognitoUser.getUsername());
+    } catch {
+      return null;
+    }
+  }
+  async getUserAttributes() {
+    const cognitoUser = await this._getAuthenticatedUser();
+    return new Promise((resolve, reject) => {
+      cognitoUser.getUserAttributes((err, result) => {
+        if (err) return reject(mapCognitoError(err));
+        resolve(Object.fromEntries((result ?? []).map((a) => [a.getName(), a.getValue()])));
+      });
+    });
+  }
+  async updateUserAttributes(attributes) {
+    const cognitoUser = await this._getAuthenticatedUser();
+    const attrs = Object.entries(attributes).map(
+      ([Name, Value]) => new amazonCognitoIdentityJs.CognitoUserAttribute({ Name, Value })
+    );
+    await new Promise((resolve, reject) => {
+      cognitoUser.updateAttributes(attrs, (err) => {
+        if (err) return reject(mapCognitoError(err));
+        resolve();
+      });
+    });
+  }
+  async verifyUserAttribute(attribute, code) {
+    const cognitoUser = await this._getAuthenticatedUser();
+    await new Promise((resolve, reject) => {
+      cognitoUser.verifyAttribute(attribute, code, {
+        onSuccess: () => resolve(),
+        onFailure: (err) => reject(mapCognitoError(err))
+      });
+    });
+  }
+  async sendAttributeVerificationCode(attribute) {
+    const cognitoUser = await this._getAuthenticatedUser();
+    await new Promise((resolve, reject) => {
+      cognitoUser.getAttributeVerificationCode(attribute, {
+        onSuccess: () => resolve(),
+        onFailure: (err) => reject(mapCognitoError(err)),
+        inputVerificationCode: () => resolve()
+      });
+    });
+  }
+  async deleteUser() {
+    const cognitoUser = await this._getAuthenticatedUser();
+    this._clearRefreshTimer();
+    await new Promise((resolve, reject) => {
+      cognitoUser.deleteUser((err) => {
+        if (err) return reject(mapCognitoError(err));
+        this.setState("unauthenticated");
+        this.emit("signedOut");
+        resolve();
+      });
+    });
+  }
+  // ─── MFA ───────────────────────────────────────────────────────────────────
+  async setupTotp() {
+    const cognitoUser = await this._getAuthenticatedUser();
+    return new Promise((resolve, reject) => {
+      cognitoUser.associateSoftwareToken({
+        associateSecretCode: (secretCode) => {
+          const issuer = encodeURIComponent(this.config.totpIssuer);
+          const account = encodeURIComponent(cognitoUser.getUsername());
+          const qrCodeUri = `otpauth://totp/${issuer}:${account}?secret=${secretCode}&issuer=${issuer}`;
+          resolve({ secretCode, qrCodeUri });
+        },
+        onFailure: (err) => reject(mapCognitoError(err))
+      });
+    });
+  }
+  async verifyTotpSetup(code) {
+    const cognitoUser = await this._getAuthenticatedUser();
+    return new Promise((resolve, reject) => {
+      cognitoUser.verifySoftwareToken(code, this.config.totpIssuer, {
+        onSuccess: () => resolve(),
+        onFailure: (err) => reject(mapCognitoError(err))
+      });
+    });
+  }
+  async getMfaPreference() {
+    const session = await this.getSession();
+    try {
+      const response = await this._getIdpClient().send(
+        new clientCognitoIdentityProvider.GetUserCommand({ AccessToken: session.accessToken })
+      );
+      const enabled = response.UserMFASettingList ?? [];
+      const preferred = response.PreferredMfaSetting ?? null;
+      const toSdkType = (s) => s === "SOFTWARE_TOKEN_MFA" ? "TOTP" : s === "SMS_MFA" ? "SMS" : null;
+      return {
+        enabled: enabled.length > 0,
+        preferred: toSdkType(preferred),
+        totp: enabled.includes("SOFTWARE_TOKEN_MFA"),
+        sms: enabled.includes("SMS_MFA")
+      };
+    } catch (err) {
+      throw mapCognitoError(err);
+    }
+  }
+  async setMfaPreference(type) {
+    const cognitoUser = await this._getAuthenticatedUser();
+    const smsMfa = { Enabled: type === "SMS", PreferredMfa: type === "SMS" };
+    const totpMfa = { Enabled: type === "TOTP", PreferredMfa: type === "TOTP" };
+    return new Promise((resolve, reject) => {
+      cognitoUser.setUserMfaPreference(smsMfa, totpMfa, (err) => {
+        if (err) return reject(mapCognitoError(err));
+        resolve();
+      });
+    });
+  }
+  async disableMfa() {
+    const cognitoUser = await this._getAuthenticatedUser();
+    const off = { Enabled: false, PreferredMfa: false };
+    return new Promise((resolve, reject) => {
+      cognitoUser.setUserMfaPreference(off, off, (err) => {
+        if (err) return reject(mapCognitoError(err));
+        resolve();
+      });
+    });
+  }
+  // ─── TOTP setup durante il challenge login ─────────────────────────────────
+  /**
+   * Ottiene il secretCode/QR URI per il setup TOTP durante il flusso di login
+   * (quando signIn restituisce MFA_SETUP_REQUIRED). Non richiede una sessione
+   * autenticata: usa il CognitoUser in attesa nel challenge.
+   */
+  async setupTotpChallenge(challengeSession) {
+    const cognitoUser = this._peekChallengeUser(challengeSession);
+    return new Promise((resolve, reject) => {
+      cognitoUser.associateSoftwareToken({
+        associateSecretCode: (secretCode) => {
+          const issuer = encodeURIComponent(this.config.totpIssuer);
+          const account = encodeURIComponent(cognitoUser.getUsername());
+          const qrCodeUri = `otpauth://totp/${issuer}:${account}?secret=${secretCode}&issuer=${issuer}`;
+          resolve({ secretCode, qrCodeUri });
+        },
+        onFailure: (err) => reject(mapCognitoError(err))
+      });
+    });
+  }
+  /**
+   * Verifica il codice TOTP e completa il login. Dopo questa chiamata la
+   * sessione è autenticata e il challenge viene rimosso dalla mappa.
+   */
+  async verifyTotpChallenge(challengeSession, code) {
+    const cognitoUser = this._takeChallengeUser(challengeSession);
+    return new Promise((resolve, reject) => {
+      cognitoUser.verifySoftwareToken(code, this.config.totpIssuer, {
+        onSuccess: (session) => resolve(this._onAuthSuccess(cognitoUser, session)),
+        onFailure: (err) => reject(mapCognitoError(err))
+      });
+    });
+  }
+  // ─── Private helpers ───────────────────────────────────────────────────────
+  _getIdpClient() {
+    if (!this._idpClient) {
+      this._idpClient = new clientCognitoIdentityProvider.CognitoIdentityProviderClient({ region: this.config.region });
+    }
+    return this._idpClient;
+  }
+  _makeCognitoUser(username) {
+    return new amazonCognitoIdentityJs.CognitoUser({
+      Username: username,
+      Pool: this._pool,
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      Storage: this.config.storage
+    });
+  }
+  _storeChallengeUser(cognitoUser) {
+    const id = crypto.randomUUID();
+    this._pendingChallenges.set(id, cognitoUser);
+    return id;
+  }
+  _takeChallengeUser(challengeSession) {
+    const user = this._pendingChallenges.get(challengeSession);
+    if (!user) {
+      throw new CognitoAuthError(
+        "Challenge session non valida o scaduta",
+        "UNKNOWN"
+      );
+    }
+    this._pendingChallenges.delete(challengeSession);
+    return user;
+  }
+  /** Legge il CognitoUser senza rimuoverlo dalla mappa (per setupTotpChallenge). */
+  _peekChallengeUser(challengeSession) {
+    const user = this._pendingChallenges.get(challengeSession);
+    if (!user) {
+      throw new CognitoAuthError(
+        "Challenge session non valida o scaduta",
+        "UNKNOWN"
+      );
+    }
+    return user;
+  }
+  _onAuthSuccess(cognitoUser, session) {
+    const authSession = buildAuthSession(session);
+    const authUser = buildAuthUser(session, cognitoUser.getUsername());
+    this.setState("authenticated");
+    this.emit("signedIn", authUser);
+    this._scheduleRefresh(cognitoUser, session);
+    return { status: "SUCCESS", user: authUser, session: authSession };
+  }
+  _getRawSession(cognitoUser) {
+    return new Promise((resolve, reject) => {
+      cognitoUser.getSession((err, session) => {
+        if (err || !session) {
+          return reject(err ? mapCognitoError(err) : new SessionExpiredError());
+        }
+        if (!session.isValid()) {
+          return reject(new SessionExpiredError());
+        }
+        resolve(session);
+      });
+    });
+  }
+  async _getAuthenticatedUser() {
+    const cognitoUser = this._pool.getCurrentUser();
+    if (!cognitoUser) throw new SessionExpiredError();
+    await this._getRawSession(cognitoUser);
+    return cognitoUser;
+  }
+  _scheduleRefresh(cognitoUser, session) {
+    if (!this.config.autoRefresh) return;
+    this._clearRefreshTimer();
+    const expiresAt = session.getAccessToken().getExpiration() * 1e3;
+    const refreshIn = expiresAt - Date.now() - this.config.refreshMarginSeconds * 1e3;
+    if (refreshIn <= 0) return;
+    this._refreshTimer = setTimeout(() => {
+      const refreshToken = new amazonCognitoIdentityJs.CognitoRefreshToken({
+        RefreshToken: session.getRefreshToken().getToken()
+      });
+      cognitoUser.refreshSession(refreshToken, (err, newSession) => {
+        if (err) {
+          this.emit("sessionExpired");
+          this.setState("unauthenticated");
+          return;
+        }
+        this.emit("tokenRefreshed", buildAuthSession(newSession));
+        this._scheduleRefresh(cognitoUser, newSession);
+      });
+    }, refreshIn);
+  }
+  _clearRefreshTimer() {
+    if (this._refreshTimer !== null) {
+      clearTimeout(this._refreshTimer);
+      this._refreshTimer = null;
+    }
+  }
+};
+
+exports.AutoStorageAdapter = AutoStorageAdapter;
+exports.CognitoAuthClient = CognitoAuthClient;
+exports.CognitoAuthError = CognitoAuthError;
+exports.InMemoryStorageAdapter = InMemoryStorageAdapter;
+exports.InvalidCodeError = InvalidCodeError;
+exports.LocalStorageAdapter = LocalStorageAdapter;
+exports.NotAuthorizedError = NotAuthorizedError;
+exports.SessionExpiredError = SessionExpiredError;
+exports.SessionStorageAdapter = SessionStorageAdapter;
+exports.TypedEventEmitter = TypedEventEmitter;
+exports.UserNotConfirmedError = UserNotConfirmedError;
+exports.mapCognitoError = mapCognitoError;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map