@oneblink/apps-react 11.0.0-beta.10 → 11.0.0-beta.12

package/dist/utils/mfa-requirement.js

@@ -38,7 +38,7 @@ export function formatMfaRequirementLabel(mfaRequirement) {
     const methodList = joinArray(selectedMethods.map(formatMfaRequirementMethodLabel), 'disjunction');
     return `MFA Required (${methodList} only)`;
 }
-export function formatMfaRequirementMethodLabel(method) {
+function formatMfaRequirementMethodLabel(method) {
     switch (method) {
         case 'sms':
             return 'SMS';
@@ -50,23 +50,27 @@ export function formatMfaRequirementMethodLabel(method) {
         }
     }
 }
+function mfaRequirementMethodToLoggedInMfaMethod(method) {
+    return method === 'sms' ? 'SMS_MFA' : 'SOFTWARE_TOKEN_MFA';
+}
+export function isMfaMethodUsedForLogin(mfaSettings, method) {
+    return (mfaSettings.loggedInWithMfaMethod ===
+        mfaRequirementMethodToLoggedInMfaMethod(method));
+}
 export function userMeetsMfaRequirement(mfaRequirement, mfaSettings) {
     if (!isMfaRequired(mfaRequirement)) {
         return true;
     }
-    if ((mfaRequirement === null || mfaRequirement === void 0 ? void 0 : mfaRequirement.sms) &&
-        mfaSettings.sms.enabled &&
-        mfaSettings.sms.preferred) {
+    if ((mfaRequirement === null || mfaRequirement === void 0 ? void 0 : mfaRequirement.sms) && mfaSettings.loggedInWithMfaMethod === 'SMS_MFA') {
         return true;
     }
     if ((mfaRequirement === null || mfaRequirement === void 0 ? void 0 : mfaRequirement.authenticatorApp) &&
-        mfaSettings.authenticator.enabled &&
-        mfaSettings.authenticator.preferred) {
+        mfaSettings.loggedInWithMfaMethod === 'SOFTWARE_TOKEN_MFA') {
         return true;
     }
     return false;
 }
-export function formatMfaMethodNotAcceptedMessage(method, mfaRequirement, accessScopeLabel = 'app') {
+function formatMfaMethodNotAcceptedMessage(method, mfaRequirement, accessScopeLabel = 'app') {
     if (!mfaRequirement || !isMfaRequired(mfaRequirement)) {
         return undefined;
     }
@@ -77,24 +81,69 @@ export function formatMfaMethodNotAcceptedMessage(method, mfaRequirement, access
     const methodList = joinArray(requiredMethods.map(formatMfaRequirementMethodLabel), 'disjunction');
     return `This MFA method is not sufficient for using this ${accessScopeLabel.toLowerCase()}. Your administrator requires ${methodList} multi factor authentication.`;
 }
+function isMfaMethodEnabled(mfaSettings, method) {
+    return method === 'sms'
+        ? mfaSettings.sms.enabled
+        : mfaSettings.authenticator.enabled;
+}
+function isMfaMethodPreferred(mfaSettings, method) {
+    return method === 'sms'
+        ? mfaSettings.sms.preferred
+        : mfaSettings.authenticator.preferred;
+}
+function hasPreferredEnabledRequiredMethod(mfaRequirement, mfaSettings) {
+    return mfaRequirementToSelectedMethods(mfaRequirement).some((method) => isMfaMethodEnabled(mfaSettings, method) &&
+        isMfaMethodPreferred(mfaSettings, method));
+}
 export function formatMfaSetupRequiredMessage(mfaRequirement, mfaSettings, accessScopeLabel = 'Account') {
-    if (!isMfaRequired(mfaRequirement) ||
+    if (!mfaRequirement ||
+        !isMfaRequired(mfaRequirement) ||
         userMeetsMfaRequirement(mfaRequirement, mfaSettings)) {
         return undefined;
     }
     const requiredMethods = mfaRequirementToSelectedMethods(mfaRequirement);
-    const hasAnyMfaEnabled = mfaSettings.authenticator.enabled || mfaSettings.sms.enabled;
     if (requiredMethods.length === 1) {
-        const methodLabel = formatMfaRequirementMethodLabel(requiredMethods[0]);
-        if (hasAnyMfaEnabled) {
-            return `requires ${methodLabel} multi factor authentication. You have a different MFA method configured, but that method is not accepted for this ${accessScopeLabel.toLowerCase()}.`;
+        const method = requiredMethods[0];
+        const methodLabel = formatMfaRequirementMethodLabel(method);
+        if (!isMfaMethodEnabled(mfaSettings, method)) {
+            return `requires ${methodLabel} multi factor authentication to be configured before accessing this ${accessScopeLabel}.`;
+        }
+        if (!isMfaMethodPreferred(mfaSettings, method)) {
+            return `requires ${methodLabel} multi factor authentication. Please change your preferred MFA method to ${methodLabel} to access this ${accessScopeLabel}.`;
         }
-        return `requires ${methodLabel} multi factor authentication to be configured before accessing this ${accessScopeLabel}.`;
+        return `requires ${methodLabel} multi factor authentication. Now that ${methodLabel} is your preferred MFA method, you must log out and log back in to access this ${accessScopeLabel}.`;
     }
     const methodList = joinArray(requiredMethods.map(formatMfaRequirementMethodLabel), 'disjunction');
-    if (hasAnyMfaEnabled) {
-        return `requires ${methodList} multi factor authentication. Your current MFA method is not accepted for this ${accessScopeLabel.toLowerCase()}.`;
+    const hasAnyMfaEnabled = mfaSettings.authenticator.enabled || mfaSettings.sms.enabled;
+    if (!hasAnyMfaEnabled) {
+        return `requires ${methodList} multi factor authentication to be configured before accessing this ${accessScopeLabel}.`;
+    }
+    if (!hasPreferredEnabledRequiredMethod(mfaRequirement, mfaSettings)) {
+        return `requires ${methodList} multi factor authentication. Please change your preferred MFA method to one of the accepted methods to access this ${accessScopeLabel}.`;
+    }
+    return `requires ${methodList} multi factor authentication. Now that your preferred MFA method meets this requirement, you must log out and log back in to access this ${accessScopeLabel}.`;
+}
+export function formatMfaMethodRequirementMessage(method, mfaRequirement, mfaSettings, accessScopeLabel = 'app') {
+    if (!mfaRequirement || !isMfaRequired(mfaRequirement)) {
+        return undefined;
+    }
+    const scope = accessScopeLabel.toLowerCase();
+    if (!mfaRequirement[method]) {
+        return formatMfaMethodNotAcceptedMessage(method, mfaRequirement, accessScopeLabel);
+    }
+    if (userMeetsMfaRequirement(mfaRequirement, mfaSettings)) {
+        return;
+    }
+    const methodLabel = formatMfaRequirementMethodLabel(method);
+    const isMethodEnabled = isMfaMethodEnabled(mfaSettings, method);
+    const isMethodPreferred = isMfaMethodPreferred(mfaSettings, method);
+    const firstSentence = `Your administrator requires ${methodLabel} multi factor authentication.`;
+    if (!isMethodEnabled) {
+        return `${firstSentence} Setup ${methodLabel} to access this ${scope}`;
+    }
+    if (!isMethodPreferred) {
+        return `${firstSentence} Set ${methodLabel} as your preferred MFA method to access this ${scope}.`;
     }
-    return `requires ${methodList} multi factor authentication to be configured before accessing this ${accessScopeLabel}.`;
+    return `${firstSentence} Now that ${methodLabel} is your preferred MFA method, you must log out and log back in to access this ${scope}.`;
 }
 //# sourceMappingURL=mfa-requirement.js.map

package/dist/utils/mfa-requirement.js.map

@@ -1 +1 @@
-{"version":3,"file":"mfa-requirement.js","sourceRoot":"","sources":["../../src/utils/mfa-requirement.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAIvC,MAAM,UAAU,aAAa,CAC3B,cAAoD;IAEpD,OAAO,CACL,CAAC,CAAC,cAAc,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,cAAc,CAAC,gBAAgB,CAAC,CAC5E,CAAA;AACH,CAAC;AAID,MAAM,2BAA2B,GAAG,MAAM,CAAC,IAAI,CAAC;IAC9C,GAAG,EAAE,KAAK;IACV,gBAAgB,EAAE,KAAK;CACW,CAA2B,CAAA;AAE/D,MAAM,UAAU,+BAA+B,CAC7C,cAAoD;;IAEpD,MAAM,aAAa,GAAG;QACpB,GAAG,EAAE,MAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,GAAG,mCAAI,KAAK;QACjC,gBAAgB,EAAE,MAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,gBAAgB,mCAAI,KAAK;KAC5D,CAAA;IACD,MAAM,OAAO,GAA2B,EAAE,CAAA;IAE1C,IAAI,aAAa,CAAC,gBAAgB,EAAE,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;IAClC,CAAC;IAED,IAAI,aAAa,CAAC,GAAG,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,OAA+B;IAE/B,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC5B,gBAAgB,EAAE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;KACvD,CAAA;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,cAAoD;IAEpD,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,CAAC;QACnC,OAAO,cAAc,CAAA;IACvB,CAAC;IAED,MAAM,eAAe,GAAG,+BAA+B,CAAC,cAAc,CAAC,CAAA;IAEvE,IAAI,eAAe,CAAC,MAAM,KAAK,2BAA2B,CAAC,MAAM,EAAE,CAAC;QAClE,OAAO,cAAc,CAAA;IACvB,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAC1B,eAAe,CAAC,GAAG,CAAC,+BAA+B,CAAC,EACpD,aAAa,CACd,CAAA;IAED,OAAO,iBAAiB,UAAU,QAAQ,CAAA;AAC5C,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,MAA4B;IAE5B,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,KAAK;YACR,OAAO,KAAK,CAAA;QACd,KAAK,kBAAkB;YACrB,OAAO,mBAAmB,CAAA;QAC5B,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,CAAC,GAAU,MAAM,CAAA;YACvB,OAAO,CAAC,CAAA;QACV,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,cAAoD,EACpD,WAAwB;IAExB,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IACE,CAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,GAAG;QACnB,WAAW,CAAC,GAAG,CAAC,OAAO;QACvB,WAAW,CAAC,GAAG,CAAC,SAAS,EACzB,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IACE,CAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,gBAAgB;QAChC,WAAW,CAAC,aAAa,CAAC,OAAO;QACjC,WAAW,CAAC,aAAa,CAAC,SAAS,EACnC,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,MAA4B,EAC5B,cAAoD,EACpD,gBAAgB,GAAG,KAAK;IAExB,IAAI,CAAC,cAAc,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,CAAC;QACtD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,eAAe,GAAG,+BAA+B,CAAC,cAAc,CAAC,CAAA;IAEvE,MAAM,UAAU,GAAG,SAAS,CAC1B,eAAe,CAAC,GAAG,CAAC,+BAA+B,CAAC,EACpD,aAAa,CACd,CAAA;IAED,OAAO,oDAAoD,gBAAgB,CAAC,WAAW,EAAE,iCAAiC,UAAU,+BAA+B,CAAA;AACrK,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,cAAoD,EACpD,WAAwB,EACxB,gBAAgB,GAAG,SAAS;IAE5B,IACE,CAAC,aAAa,CAAC,cAAc,CAAC;QAC9B,uBAAuB,CAAC,cAAc,EAAE,WAAW,CAAC,EACpD,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,eAAe,GAAG,+BAA+B,CAAC,cAAc,CAAC,CAAA;IACvE,MAAM,gBAAgB,GACpB,WAAW,CAAC,aAAa,CAAC,OAAO,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAA;IAE9D,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,WAAW,GAAG,+BAA+B,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAA;QAEvE,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,YAAY,WAAW,sHAAsH,gBAAgB,CAAC,WAAW,EAAE,GAAG,CAAA;QACvL,CAAC;QAED,OAAO,YAAY,WAAW,uEAAuE,gBAAgB,GAAG,CAAA;IAC1H,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAC1B,eAAe,CAAC,GAAG,CAAC,+BAA+B,CAAC,EACpD,aAAa,CACd,CAAA;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,YAAY,UAAU,kFAAkF,gBAAgB,CAAC,WAAW,EAAE,GAAG,CAAA;IAClJ,CAAC;IAED,OAAO,YAAY,UAAU,uEAAuE,gBAAgB,GAAG,CAAA;AACzH,CAAC","sourcesContent":["import { MiscTypes } from '@oneblink/types'\r\nimport type { MfaSettings } from '../apps/services/AWSCognitoClient'\r\nimport { joinArray } from './joinArray'\r\n\r\nexport type { MfaSettings }\r\n\r\nexport function isMfaRequired(\r\n  mfaRequirement: MiscTypes.MfaRequirement | undefined,\r\n): boolean {\r\n  return (\r\n    !!mfaRequirement && (mfaRequirement.sms || mfaRequirement.authenticatorApp)\r\n  )\r\n}\r\n\r\nexport type MfaRequirementMethod = keyof MiscTypes.MfaRequirement\r\n\r\nconst MFA_REQUIREMENT_METHOD_KEYS = Object.keys({\r\n  sms: false,\r\n  authenticatorApp: false,\r\n} satisfies MiscTypes.MfaRequirement) as MfaRequirementMethod[]\r\n\r\nexport function mfaRequirementToSelectedMethods(\r\n  mfaRequirement: MiscTypes.MfaRequirement | undefined,\r\n): MfaRequirementMethod[] {\r\n  const checkboxState = {\r\n    sms: mfaRequirement?.sms ?? false,\r\n    authenticatorApp: mfaRequirement?.authenticatorApp ?? false,\r\n  }\r\n  const methods: MfaRequirementMethod[] = []\r\n\r\n  if (checkboxState.authenticatorApp) {\r\n    methods.push('authenticatorApp')\r\n  }\r\n\r\n  if (checkboxState.sms) {\r\n    methods.push('sms')\r\n  }\r\n\r\n  return methods\r\n}\r\n\r\nexport function mfaSelectedMethodsToMfaRequirement(\r\n  methods: MfaRequirementMethod[],\r\n): MiscTypes.MfaRequirement {\r\n  return {\r\n    sms: methods.includes('sms'),\r\n    authenticatorApp: methods.includes('authenticatorApp'),\r\n  }\r\n}\r\n\r\nexport function formatMfaRequirementLabel(\r\n  mfaRequirement: MiscTypes.MfaRequirement | undefined,\r\n): string {\r\n  if (!isMfaRequired(mfaRequirement)) {\r\n    return 'MFA Optional'\r\n  }\r\n\r\n  const selectedMethods = mfaRequirementToSelectedMethods(mfaRequirement)\r\n\r\n  if (selectedMethods.length === MFA_REQUIREMENT_METHOD_KEYS.length) {\r\n    return 'MFA Required'\r\n  }\r\n\r\n  const methodList = joinArray(\r\n    selectedMethods.map(formatMfaRequirementMethodLabel),\r\n    'disjunction',\r\n  )\r\n\r\n  return `MFA Required (${methodList} only)`\r\n}\r\n\r\nexport function formatMfaRequirementMethodLabel(\r\n  method: MfaRequirementMethod,\r\n): string {\r\n  switch (method) {\r\n    case 'sms':\r\n      return 'SMS'\r\n    case 'authenticatorApp':\r\n      return 'Authenticator App'\r\n    default: {\r\n      const n: never = method\r\n      return n\r\n    }\r\n  }\r\n}\r\n\r\nexport function userMeetsMfaRequirement(\r\n  mfaRequirement: MiscTypes.MfaRequirement | undefined,\r\n  mfaSettings: MfaSettings,\r\n): boolean {\r\n  if (!isMfaRequired(mfaRequirement)) {\r\n    return true\r\n  }\r\n\r\n  if (\r\n    mfaRequirement?.sms &&\r\n    mfaSettings.sms.enabled &&\r\n    mfaSettings.sms.preferred\r\n  ) {\r\n    return true\r\n  }\r\n\r\n  if (\r\n    mfaRequirement?.authenticatorApp &&\r\n    mfaSettings.authenticator.enabled &&\r\n    mfaSettings.authenticator.preferred\r\n  ) {\r\n    return true\r\n  }\r\n\r\n  return false\r\n}\r\n\r\nexport function formatMfaMethodNotAcceptedMessage(\r\n  method: MfaRequirementMethod,\r\n  mfaRequirement: MiscTypes.MfaRequirement | undefined,\r\n  accessScopeLabel = 'app',\r\n): string | undefined {\r\n  if (!mfaRequirement || !isMfaRequired(mfaRequirement)) {\r\n    return undefined\r\n  }\r\n\r\n  if (mfaRequirement[method]) {\r\n    return undefined\r\n  }\r\n\r\n  const requiredMethods = mfaRequirementToSelectedMethods(mfaRequirement)\r\n\r\n  const methodList = joinArray(\r\n    requiredMethods.map(formatMfaRequirementMethodLabel),\r\n    'disjunction',\r\n  )\r\n\r\n  return `This MFA method is not sufficient for using this ${accessScopeLabel.toLowerCase()}. Your administrator requires ${methodList} multi factor authentication.`\r\n}\r\n\r\nexport function formatMfaSetupRequiredMessage(\r\n  mfaRequirement: MiscTypes.MfaRequirement | undefined,\r\n  mfaSettings: MfaSettings,\r\n  accessScopeLabel = 'Account',\r\n): string | undefined {\r\n  if (\r\n    !isMfaRequired(mfaRequirement) ||\r\n    userMeetsMfaRequirement(mfaRequirement, mfaSettings)\r\n  ) {\r\n    return undefined\r\n  }\r\n\r\n  const requiredMethods = mfaRequirementToSelectedMethods(mfaRequirement)\r\n  const hasAnyMfaEnabled =\r\n    mfaSettings.authenticator.enabled || mfaSettings.sms.enabled\r\n\r\n  if (requiredMethods.length === 1) {\r\n    const methodLabel = formatMfaRequirementMethodLabel(requiredMethods[0])\r\n\r\n    if (hasAnyMfaEnabled) {\r\n      return `requires ${methodLabel} multi factor authentication. You have a different MFA method configured, but that method is not accepted for this ${accessScopeLabel.toLowerCase()}.`\r\n    }\r\n\r\n    return `requires ${methodLabel} multi factor authentication to be configured before accessing this ${accessScopeLabel}.`\r\n  }\r\n\r\n  const methodList = joinArray(\r\n    requiredMethods.map(formatMfaRequirementMethodLabel),\r\n    'disjunction',\r\n  )\r\n\r\n  if (hasAnyMfaEnabled) {\r\n    return `requires ${methodList} multi factor authentication. Your current MFA method is not accepted for this ${accessScopeLabel.toLowerCase()}.`\r\n  }\r\n\r\n  return `requires ${methodList} multi factor authentication to be configured before accessing this ${accessScopeLabel}.`\r\n}\r\n"]}
+{"version":3,"file":"mfa-requirement.js","sourceRoot":"","sources":["../../src/utils/mfa-requirement.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAIvC,MAAM,UAAU,aAAa,CAC3B,cAAoD;IAEpD,OAAO,CACL,CAAC,CAAC,cAAc,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,cAAc,CAAC,gBAAgB,CAAC,CAC5E,CAAA;AACH,CAAC;AAID,MAAM,2BAA2B,GAAG,MAAM,CAAC,IAAI,CAAC;IAC9C,GAAG,EAAE,KAAK;IACV,gBAAgB,EAAE,KAAK;CACW,CAA2B,CAAA;AAE/D,MAAM,UAAU,+BAA+B,CAC7C,cAAoD;;IAEpD,MAAM,aAAa,GAAG;QACpB,GAAG,EAAE,MAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,GAAG,mCAAI,KAAK;QACjC,gBAAgB,EAAE,MAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,gBAAgB,mCAAI,KAAK;KAC5D,CAAA;IACD,MAAM,OAAO,GAA2B,EAAE,CAAA;IAE1C,IAAI,aAAa,CAAC,gBAAgB,EAAE,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;IAClC,CAAC;IAED,IAAI,aAAa,CAAC,GAAG,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,OAA+B;IAE/B,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC5B,gBAAgB,EAAE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;KACvD,CAAA;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,cAAoD;IAEpD,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,CAAC;QACnC,OAAO,cAAc,CAAA;IACvB,CAAC;IAED,MAAM,eAAe,GAAG,+BAA+B,CAAC,cAAc,CAAC,CAAA;IAEvE,IAAI,eAAe,CAAC,MAAM,KAAK,2BAA2B,CAAC,MAAM,EAAE,CAAC;QAClE,OAAO,cAAc,CAAA;IACvB,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAC1B,eAAe,CAAC,GAAG,CAAC,+BAA+B,CAAC,EACpD,aAAa,CACd,CAAA;IAED,OAAO,iBAAiB,UAAU,QAAQ,CAAA;AAC5C,CAAC;AAED,SAAS,+BAA+B,CAAC,MAA4B;IACnE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,KAAK;YACR,OAAO,KAAK,CAAA;QACd,KAAK,kBAAkB;YACrB,OAAO,mBAAmB,CAAA;QAC5B,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,CAAC,GAAU,MAAM,CAAA;YACvB,OAAO,CAAC,CAAA;QACV,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,uCAAuC,CAC9C,MAA4B;IAE5B,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAA;AAC5D,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,WAAwB,EACxB,MAA4B;IAE5B,OAAO,CACL,WAAW,CAAC,qBAAqB;QACjC,uCAAuC,CAAC,MAAM,CAAC,CAChD,CAAA;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,cAAoD,EACpD,WAAwB;IAExB,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,CAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,GAAG,KAAI,WAAW,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IACE,CAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,gBAAgB;QAChC,WAAW,CAAC,qBAAqB,KAAK,oBAAoB,EAC1D,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,iCAAiC,CACxC,MAA4B,EAC5B,cAAoD,EACpD,gBAAgB,GAAG,KAAK;IAExB,IAAI,CAAC,cAAc,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,CAAC;QACtD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,eAAe,GAAG,+BAA+B,CAAC,cAAc,CAAC,CAAA;IAEvE,MAAM,UAAU,GAAG,SAAS,CAC1B,eAAe,CAAC,GAAG,CAAC,+BAA+B,CAAC,EACpD,aAAa,CACd,CAAA;IAED,OAAO,oDAAoD,gBAAgB,CAAC,WAAW,EAAE,iCAAiC,UAAU,+BAA+B,CAAA;AACrK,CAAC;AAED,SAAS,kBAAkB,CACzB,WAAwB,EACxB,MAA4B;IAE5B,OAAO,MAAM,KAAK,KAAK;QACrB,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO;QACzB,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,OAAO,CAAA;AACvC,CAAC;AAED,SAAS,oBAAoB,CAC3B,WAAwB,EACxB,MAA4B;IAE5B,OAAO,MAAM,KAAK,KAAK;QACrB,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS;QAC3B,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,SAAS,CAAA;AACzC,CAAC;AAED,SAAS,iCAAiC,CACxC,cAAwC,EACxC,WAAwB;IAExB,OAAO,+BAA+B,CAAC,cAAc,CAAC,CAAC,IAAI,CACzD,CAAC,MAAM,EAAE,EAAE,CACT,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC;QACvC,oBAAoB,CAAC,WAAW,EAAE,MAAM,CAAC,CAC5C,CAAA;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,cAAoD,EACpD,WAAwB,EACxB,gBAAgB,GAAG,SAAS;IAE5B,IACE,CAAC,cAAc;QACf,CAAC,aAAa,CAAC,cAAc,CAAC;QAC9B,uBAAuB,CAAC,cAAc,EAAE,WAAW,CAAC,EACpD,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,eAAe,GAAG,+BAA+B,CAAC,cAAc,CAAC,CAAA;IAEvE,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,WAAW,GAAG,+BAA+B,CAAC,MAAM,CAAC,CAAA;QAE3D,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC;YAC7C,OAAO,YAAY,WAAW,uEAAuE,gBAAgB,GAAG,CAAA;QAC1H,CAAC;QAED,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC;YAC/C,OAAO,YAAY,WAAW,4EAA4E,WAAW,mBAAmB,gBAAgB,GAAG,CAAA;QAC7J,CAAC;QAED,OAAO,YAAY,WAAW,0CAA0C,WAAW,kFAAkF,gBAAgB,GAAG,CAAA;IAC1L,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAC1B,eAAe,CAAC,GAAG,CAAC,+BAA+B,CAAC,EACpD,aAAa,CACd,CAAA;IACD,MAAM,gBAAgB,GACpB,WAAW,CAAC,aAAa,CAAC,OAAO,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAA;IAE9D,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,YAAY,UAAU,uEAAuE,gBAAgB,GAAG,CAAA;IACzH,CAAC;IAED,IAAI,CAAC,iCAAiC,CAAC,cAAc,EAAE,WAAW,CAAC,EAAE,CAAC;QACpE,OAAO,YAAY,UAAU,uHAAuH,gBAAgB,GAAG,CAAA;IACzK,CAAC;IAED,OAAO,YAAY,UAAU,4IAA4I,gBAAgB,GAAG,CAAA;AAC9L,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,MAA4B,EAC5B,cAAoD,EACpD,WAAwB,EACxB,gBAAgB,GAAG,KAAK;IAExB,IAAI,CAAC,cAAc,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,CAAC;QACtD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,WAAW,EAAE,CAAA;IAE5C,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,OAAO,iCAAiC,CACtC,MAAM,EACN,cAAc,EACd,gBAAgB,CACjB,CAAA;IACH,CAAC;IAED,IAAI,uBAAuB,CAAC,cAAc,EAAE,WAAW,CAAC,EAAE,CAAC;QACzD,OAAM;IACR,CAAC;IAED,MAAM,WAAW,GAAG,+BAA+B,CAAC,MAAM,CAAC,CAAA;IAC3D,MAAM,eAAe,GAAG,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;IAC/D,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;IAEnE,MAAM,aAAa,GAAG,+BAA+B,WAAW,+BAA+B,CAAA;IAE/F,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,GAAG,aAAa,UAAU,WAAW,mBAAmB,KAAK,EAAE,CAAA;IACxE,CAAC;IAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO,GAAG,aAAa,QAAQ,WAAW,gDAAgD,KAAK,GAAG,CAAA;IACpG,CAAC;IAED,OAAO,GAAG,aAAa,aAAa,WAAW,kFAAkF,KAAK,GAAG,CAAA;AAC3I,CAAC","sourcesContent":["import { MiscTypes } from '@oneblink/types'\r\nimport type {\r\n  LoggedInMfaMethod,\r\n  MfaSettings,\r\n} from '../apps/services/AWSCognitoClient'\r\nimport { joinArray } from './joinArray'\r\n\r\nexport type { LoggedInMfaMethod, MfaSettings }\r\n\r\nexport function isMfaRequired(\r\n  mfaRequirement: MiscTypes.MfaRequirement | undefined,\r\n): boolean {\r\n  return (\r\n    !!mfaRequirement && (mfaRequirement.sms || mfaRequirement.authenticatorApp)\r\n  )\r\n}\r\n\r\nexport type MfaRequirementMethod = keyof MiscTypes.MfaRequirement\r\n\r\nconst MFA_REQUIREMENT_METHOD_KEYS = Object.keys({\r\n  sms: false,\r\n  authenticatorApp: false,\r\n} satisfies MiscTypes.MfaRequirement) as MfaRequirementMethod[]\r\n\r\nexport function mfaRequirementToSelectedMethods(\r\n  mfaRequirement: MiscTypes.MfaRequirement | undefined,\r\n): MfaRequirementMethod[] {\r\n  const checkboxState = {\r\n    sms: mfaRequirement?.sms ?? false,\r\n    authenticatorApp: mfaRequirement?.authenticatorApp ?? false,\r\n  }\r\n  const methods: MfaRequirementMethod[] = []\r\n\r\n  if (checkboxState.authenticatorApp) {\r\n    methods.push('authenticatorApp')\r\n  }\r\n\r\n  if (checkboxState.sms) {\r\n    methods.push('sms')\r\n  }\r\n\r\n  return methods\r\n}\r\n\r\nexport function mfaSelectedMethodsToMfaRequirement(\r\n  methods: MfaRequirementMethod[],\r\n): MiscTypes.MfaRequirement {\r\n  return {\r\n    sms: methods.includes('sms'),\r\n    authenticatorApp: methods.includes('authenticatorApp'),\r\n  }\r\n}\r\n\r\nexport function formatMfaRequirementLabel(\r\n  mfaRequirement: MiscTypes.MfaRequirement | undefined,\r\n): string {\r\n  if (!isMfaRequired(mfaRequirement)) {\r\n    return 'MFA Optional'\r\n  }\r\n\r\n  const selectedMethods = mfaRequirementToSelectedMethods(mfaRequirement)\r\n\r\n  if (selectedMethods.length === MFA_REQUIREMENT_METHOD_KEYS.length) {\r\n    return 'MFA Required'\r\n  }\r\n\r\n  const methodList = joinArray(\r\n    selectedMethods.map(formatMfaRequirementMethodLabel),\r\n    'disjunction',\r\n  )\r\n\r\n  return `MFA Required (${methodList} only)`\r\n}\r\n\r\nfunction formatMfaRequirementMethodLabel(method: MfaRequirementMethod): string {\r\n  switch (method) {\r\n    case 'sms':\r\n      return 'SMS'\r\n    case 'authenticatorApp':\r\n      return 'Authenticator App'\r\n    default: {\r\n      const n: never = method\r\n      return n\r\n    }\r\n  }\r\n}\r\n\r\nfunction mfaRequirementMethodToLoggedInMfaMethod(\r\n  method: MfaRequirementMethod,\r\n): Exclude<LoggedInMfaMethod, 'NO_MFA_ENABLED'> {\r\n  return method === 'sms' ? 'SMS_MFA' : 'SOFTWARE_TOKEN_MFA'\r\n}\r\n\r\nexport function isMfaMethodUsedForLogin(\r\n  mfaSettings: MfaSettings,\r\n  method: MfaRequirementMethod,\r\n): boolean {\r\n  return (\r\n    mfaSettings.loggedInWithMfaMethod ===\r\n    mfaRequirementMethodToLoggedInMfaMethod(method)\r\n  )\r\n}\r\n\r\nexport function userMeetsMfaRequirement(\r\n  mfaRequirement: MiscTypes.MfaRequirement | undefined,\r\n  mfaSettings: MfaSettings,\r\n): boolean {\r\n  if (!isMfaRequired(mfaRequirement)) {\r\n    return true\r\n  }\r\n\r\n  if (mfaRequirement?.sms && mfaSettings.loggedInWithMfaMethod === 'SMS_MFA') {\r\n    return true\r\n  }\r\n\r\n  if (\r\n    mfaRequirement?.authenticatorApp &&\r\n    mfaSettings.loggedInWithMfaMethod === 'SOFTWARE_TOKEN_MFA'\r\n  ) {\r\n    return true\r\n  }\r\n\r\n  return false\r\n}\r\n\r\nfunction formatMfaMethodNotAcceptedMessage(\r\n  method: MfaRequirementMethod,\r\n  mfaRequirement: MiscTypes.MfaRequirement | undefined,\r\n  accessScopeLabel = 'app',\r\n): string | undefined {\r\n  if (!mfaRequirement || !isMfaRequired(mfaRequirement)) {\r\n    return undefined\r\n  }\r\n\r\n  if (mfaRequirement[method]) {\r\n    return undefined\r\n  }\r\n\r\n  const requiredMethods = mfaRequirementToSelectedMethods(mfaRequirement)\r\n\r\n  const methodList = joinArray(\r\n    requiredMethods.map(formatMfaRequirementMethodLabel),\r\n    'disjunction',\r\n  )\r\n\r\n  return `This MFA method is not sufficient for using this ${accessScopeLabel.toLowerCase()}. Your administrator requires ${methodList} multi factor authentication.`\r\n}\r\n\r\nfunction isMfaMethodEnabled(\r\n  mfaSettings: MfaSettings,\r\n  method: MfaRequirementMethod,\r\n): boolean {\r\n  return method === 'sms'\r\n    ? mfaSettings.sms.enabled\r\n    : mfaSettings.authenticator.enabled\r\n}\r\n\r\nfunction isMfaMethodPreferred(\r\n  mfaSettings: MfaSettings,\r\n  method: MfaRequirementMethod,\r\n): boolean {\r\n  return method === 'sms'\r\n    ? mfaSettings.sms.preferred\r\n    : mfaSettings.authenticator.preferred\r\n}\r\n\r\nfunction hasPreferredEnabledRequiredMethod(\r\n  mfaRequirement: MiscTypes.MfaRequirement,\r\n  mfaSettings: MfaSettings,\r\n): boolean {\r\n  return mfaRequirementToSelectedMethods(mfaRequirement).some(\r\n    (method) =>\r\n      isMfaMethodEnabled(mfaSettings, method) &&\r\n      isMfaMethodPreferred(mfaSettings, method),\r\n  )\r\n}\r\n\r\nexport function formatMfaSetupRequiredMessage(\r\n  mfaRequirement: MiscTypes.MfaRequirement | undefined,\r\n  mfaSettings: MfaSettings,\r\n  accessScopeLabel = 'Account',\r\n): string | undefined {\r\n  if (\r\n    !mfaRequirement ||\r\n    !isMfaRequired(mfaRequirement) ||\r\n    userMeetsMfaRequirement(mfaRequirement, mfaSettings)\r\n  ) {\r\n    return undefined\r\n  }\r\n\r\n  const requiredMethods = mfaRequirementToSelectedMethods(mfaRequirement)\r\n\r\n  if (requiredMethods.length === 1) {\r\n    const method = requiredMethods[0]\r\n    const methodLabel = formatMfaRequirementMethodLabel(method)\r\n\r\n    if (!isMfaMethodEnabled(mfaSettings, method)) {\r\n      return `requires ${methodLabel} multi factor authentication to be configured before accessing this ${accessScopeLabel}.`\r\n    }\r\n\r\n    if (!isMfaMethodPreferred(mfaSettings, method)) {\r\n      return `requires ${methodLabel} multi factor authentication. Please change your preferred MFA method to ${methodLabel} to access this ${accessScopeLabel}.`\r\n    }\r\n\r\n    return `requires ${methodLabel} multi factor authentication. Now that ${methodLabel} is your preferred MFA method, you must log out and log back in to access this ${accessScopeLabel}.`\r\n  }\r\n\r\n  const methodList = joinArray(\r\n    requiredMethods.map(formatMfaRequirementMethodLabel),\r\n    'disjunction',\r\n  )\r\n  const hasAnyMfaEnabled =\r\n    mfaSettings.authenticator.enabled || mfaSettings.sms.enabled\r\n\r\n  if (!hasAnyMfaEnabled) {\r\n    return `requires ${methodList} multi factor authentication to be configured before accessing this ${accessScopeLabel}.`\r\n  }\r\n\r\n  if (!hasPreferredEnabledRequiredMethod(mfaRequirement, mfaSettings)) {\r\n    return `requires ${methodList} multi factor authentication. Please change your preferred MFA method to one of the accepted methods to access this ${accessScopeLabel}.`\r\n  }\r\n\r\n  return `requires ${methodList} multi factor authentication. Now that your preferred MFA method meets this requirement, you must log out and log back in to access this ${accessScopeLabel}.`\r\n}\r\n\r\nexport function formatMfaMethodRequirementMessage(\r\n  method: MfaRequirementMethod,\r\n  mfaRequirement: MiscTypes.MfaRequirement | undefined,\r\n  mfaSettings: MfaSettings,\r\n  accessScopeLabel = 'app',\r\n): string | undefined {\r\n  if (!mfaRequirement || !isMfaRequired(mfaRequirement)) {\r\n    return undefined\r\n  }\r\n\r\n  const scope = accessScopeLabel.toLowerCase()\r\n\r\n  if (!mfaRequirement[method]) {\r\n    return formatMfaMethodNotAcceptedMessage(\r\n      method,\r\n      mfaRequirement,\r\n      accessScopeLabel,\r\n    )\r\n  }\r\n\r\n  if (userMeetsMfaRequirement(mfaRequirement, mfaSettings)) {\r\n    return\r\n  }\r\n\r\n  const methodLabel = formatMfaRequirementMethodLabel(method)\r\n  const isMethodEnabled = isMfaMethodEnabled(mfaSettings, method)\r\n  const isMethodPreferred = isMfaMethodPreferred(mfaSettings, method)\r\n\r\n  const firstSentence = `Your administrator requires ${methodLabel} multi factor authentication.`\r\n\r\n  if (!isMethodEnabled) {\r\n    return `${firstSentence} Setup ${methodLabel} to access this ${scope}`\r\n  }\r\n\r\n  if (!isMethodPreferred) {\r\n    return `${firstSentence} Set ${methodLabel} as your preferred MFA method to access this ${scope}.`\r\n  }\r\n\r\n  return `${firstSentence} Now that ${methodLabel} is your preferred MFA method, you must log out and log back in to access this ${scope}.`\r\n}\r\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@oneblink/apps-react",
   "description": "Helper functions for OneBlink apps in ReactJS.",
-  "version": "11.0.0-beta.10",
+  "version": "11.0.0-beta.12",
   "author": "OneBlink <developers@oneblink.io> (https://oneblink.io)",
   "bugs": {
     "url": "https://github.com/oneblink/apps-react/issues"