@openhi/constructs 0.0.85 → 0.0.87

package/lib/post-authentication.handler.d.mts

@@ -0,0 +1,5 @@
+import { PostAuthenticationTriggerHandler } from 'aws-lambda';
+
+declare const handler: PostAuthenticationTriggerHandler;
+
+export { handler };

package/lib/post-authentication.handler.d.ts

@@ -0,0 +1,5 @@
+import { PostAuthenticationTriggerHandler } from 'aws-lambda';
+
+declare const handler: PostAuthenticationTriggerHandler;
+
+export { handler };

package/lib/post-authentication.handler.js

@@ -0,0 +1,45 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/components/cognito/post-authentication.handler.ts
+var post_authentication_handler_exports = {};
+__export(post_authentication_handler_exports, {
+  handler: () => handler
+});
+module.exports = __toCommonJS(post_authentication_handler_exports);
+var import_client_cognito_identity_provider = require("@aws-sdk/client-cognito-identity-provider");
+var client = new import_client_cognito_identity_provider.CognitoIdentityProviderClient({});
+var handler = async (event, _context) => {
+  try {
+    await client.send(
+      new import_client_cognito_identity_provider.AdminUserGlobalSignOutCommand({
+        UserPoolId: event.userPoolId,
+        Username: event.userName
+      })
+    );
+  } catch (err) {
+    console.warn("AdminUserGlobalSignOut failed; continuing sign-in", err);
+  }
+  return event;
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  handler
+});
+//# sourceMappingURL=post-authentication.handler.js.map

package/lib/post-authentication.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/components/cognito/post-authentication.handler.ts"],"sourcesContent":["import {\n  AdminUserGlobalSignOutCommand,\n  CognitoIdentityProviderClient,\n} from \"@aws-sdk/client-cognito-identity-provider\";\nimport type {\n  Context,\n  PostAuthenticationTriggerEvent,\n  PostAuthenticationTriggerHandler,\n} from \"aws-lambda\";\n\n/**\n * @see sites/www-docs/content/packages/@openhi/constructs/components/cognito/post-authentication-lambda.md\n *\n * Cognito Post Authentication trigger.\n *\n * Enforces single-device-per-user sessions (ADR 2026-03-17-01) by calling\n * AdminUserGlobalSignOut on every sign-in. Post Authentication fires only\n * on sign-in (not on token refresh), so any existing sessions on other\n * devices are revoked exactly when a new device authenticates.\n *\n * Authentication must not fail because of a sign-out failure: errors are\n * logged and the event is returned unchanged.\n */\nconst client = new CognitoIdentityProviderClient({});\n\nexport const handler: PostAuthenticationTriggerHandler = async (\n  event: PostAuthenticationTriggerEvent,\n  _context: Context,\n): Promise<PostAuthenticationTriggerEvent> => {\n  try {\n    await client.send(\n      new AdminUserGlobalSignOutCommand({\n        UserPoolId: event.userPoolId,\n        Username: event.userName,\n      }),\n    );\n  } catch (err) {\n    console.warn(\"AdminUserGlobalSignOut failed; continuing sign-in\", err);\n  }\n  return event;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,8CAGO;AAoBP,IAAM,SAAS,IAAI,sEAA8B,CAAC,CAAC;AAE5C,IAAM,UAA4C,OACvD,OACA,aAC4C;AAC5C,MAAI;AACF,UAAM,OAAO;AAAA,MACX,IAAI,sEAA8B;AAAA,QAChC,YAAY,MAAM;AAAA,QAClB,UAAU,MAAM;AAAA,MAClB,CAAC;AAAA,IACH;AAAA,EACF,SAAS,KAAK;AACZ,YAAQ,KAAK,qDAAqD,GAAG;AAAA,EACvE;AACA,SAAO;AACT;","names":[]}

package/lib/post-authentication.handler.mjs

@@ -0,0 +1,25 @@
+import "./chunk-LZOMFHX3.mjs";
+
+// src/components/cognito/post-authentication.handler.ts
+import {
+  AdminUserGlobalSignOutCommand,
+  CognitoIdentityProviderClient
+} from "@aws-sdk/client-cognito-identity-provider";
+var client = new CognitoIdentityProviderClient({});
+var handler = async (event, _context) => {
+  try {
+    await client.send(
+      new AdminUserGlobalSignOutCommand({
+        UserPoolId: event.userPoolId,
+        Username: event.userName
+      })
+    );
+  } catch (err) {
+    console.warn("AdminUserGlobalSignOut failed; continuing sign-in", err);
+  }
+  return event;
+};
+export {
+  handler
+};
+//# sourceMappingURL=post-authentication.handler.mjs.map

package/lib/post-authentication.handler.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/components/cognito/post-authentication.handler.ts"],"sourcesContent":["import {\n  AdminUserGlobalSignOutCommand,\n  CognitoIdentityProviderClient,\n} from \"@aws-sdk/client-cognito-identity-provider\";\nimport type {\n  Context,\n  PostAuthenticationTriggerEvent,\n  PostAuthenticationTriggerHandler,\n} from \"aws-lambda\";\n\n/**\n * @see sites/www-docs/content/packages/@openhi/constructs/components/cognito/post-authentication-lambda.md\n *\n * Cognito Post Authentication trigger.\n *\n * Enforces single-device-per-user sessions (ADR 2026-03-17-01) by calling\n * AdminUserGlobalSignOut on every sign-in. Post Authentication fires only\n * on sign-in (not on token refresh), so any existing sessions on other\n * devices are revoked exactly when a new device authenticates.\n *\n * Authentication must not fail because of a sign-out failure: errors are\n * logged and the event is returned unchanged.\n */\nconst client = new CognitoIdentityProviderClient({});\n\nexport const handler: PostAuthenticationTriggerHandler = async (\n  event: PostAuthenticationTriggerEvent,\n  _context: Context,\n): Promise<PostAuthenticationTriggerEvent> => {\n  try {\n    await client.send(\n      new AdminUserGlobalSignOutCommand({\n        UserPoolId: event.userPoolId,\n        Username: event.userName,\n      }),\n    );\n  } catch (err) {\n    console.warn(\"AdminUserGlobalSignOut failed; continuing sign-in\", err);\n  }\n  return event;\n};\n"],"mappings":";;;AAAA;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAoBP,IAAM,SAAS,IAAI,8BAA8B,CAAC,CAAC;AAE5C,IAAM,UAA4C,OACvD,OACA,aAC4C;AAC5C,MAAI;AACF,UAAM,OAAO;AAAA,MACX,IAAI,8BAA8B;AAAA,QAChC,YAAY,MAAM;AAAA,QAClB,UAAU,MAAM;AAAA,MAClB,CAAC;AAAA,IACH;AAAA,EACF,SAAS,KAAK;AACZ,YAAQ,KAAK,qDAAqD,GAAG;AAAA,EACvE;AACA,SAAO;AACT;","names":[]}