@vardario/cognito-client 0.1.4 → 0.1.6

package/lib/cognito-client.test.js

@@ -0,0 +1,99 @@
+import "isomorphic-fetch";
+import { GenericContainer } from "testcontainers";
+import { CognitoClient, CognitoIdentityProvider, } from "./cognito-client.js";
+import { MemorySessionStorage } from "./session-storage/index.js";
+import { newUser, setupCognito, user } from "./test-utils.js";
+import { expect, test, describe, beforeAll, beforeEach, afterAll, } from "vitest";
+describe("Cognito Client", () => {
+    let cognitoClient;
+    let container;
+    let sessionStorage = new MemorySessionStorage();
+    const oAuth2 = {
+        cognitoDomain: "http://localhost",
+        redirectUrl: "http://localhost",
+        responseType: "code",
+        scopes: ["email openid"],
+    };
+    let userPoolConfig = {
+        userPoolClientId: "",
+        userPoolId: "",
+    };
+    beforeAll(async () => {
+        const cognitoPort = 9229;
+        container = await new GenericContainer("jagregory/cognito-local")
+            .withExposedPorts(cognitoPort)
+            .start();
+        const cognitoEndpoint = `http://localhost:${container.getMappedPort(cognitoPort)}`;
+        userPoolConfig = await setupCognito(cognitoEndpoint);
+        cognitoClient = new CognitoClient({
+            userPoolId: userPoolConfig.userPoolId,
+            userPoolClientId: userPoolConfig.userPoolClientId,
+            sessionStorage: sessionStorage,
+            endpoint: cognitoEndpoint,
+            oAuth2: oAuth2,
+        });
+    });
+    beforeEach(async () => {
+        try {
+            await cognitoClient.signOut();
+        }
+        catch (error) { }
+    });
+    afterAll(async () => {
+        await container.stop();
+    });
+    test("authenticateUser", async () => {
+        const session = await cognitoClient.authenticateUser(user.email, user.password);
+        expect(session).toEqual(await cognitoClient.getSession());
+        //Simulate session expiring
+        sessionStorage.setSession({
+            ...session,
+            expiresIn: 0,
+        });
+        const newSession = await cognitoClient.getSession();
+        expect(newSession).not.toEqual(session);
+    });
+    test("authenticateUserSrp: TODO", async () => {
+        // TODO: Currently SRP auth is not supported through cognito-local
+        // const session = await cognitoClient.authenticateUserSrp(user.name, user.password);
+        // expect(session).toEqual(await cognitoClient.getSession());
+        expect(true).toBe(true);
+    });
+    test("signUp", async () => {
+        const { id, confirmed } = await cognitoClient.signUp(newUser.email, newUser.password, [
+            { Name: "givenName", Value: newUser.givenName },
+            { Name: "familyName", Value: newUser.familyName },
+        ]);
+        expect(id).toBeDefined();
+        expect(confirmed).toBe(false);
+    });
+    test("changePassword", async () => {
+        const newPassword = "newPassword";
+        expect(cognitoClient.changePassword(user.password, newPassword)).rejects.toThrow();
+        await cognitoClient.authenticateUser(user.email, user.password);
+        await cognitoClient.changePassword(user.password, newPassword);
+        await cognitoClient.signOut();
+        expect(cognitoClient.authenticateUser(user.email, user.password)).rejects.toThrow();
+        await cognitoClient.authenticateUser(user.email, "newPassword");
+    });
+    test("generateOAuthSignInUrl", () => {
+        const _test = (cb, identityProvider) => {
+            const hostedUIUrl = cognitoClient.generateOAuthSignInUrl(identityProvider);
+            const { searchParams } = new URL(hostedUIUrl);
+            expect(searchParams.get("redirect_uri")).toBe(oAuth2.redirectUrl);
+            expect(searchParams.get("response_type")).toBe(oAuth2.responseType);
+            expect(searchParams.get("client_id")).toBe(userPoolConfig.userPoolClientId);
+            expect(searchParams.get("scope")).toBe(oAuth2.scopes.join(" "));
+            expect(searchParams.get("state")).toBeDefined();
+            expect(searchParams.get("code_challenge")).toBeDefined();
+            expect(searchParams.get("code_challenge_method")).toBe("S256");
+            cb(searchParams);
+        };
+        _test((searchParams) => {
+            expect(searchParams.get("identity_provider")).toBeNull();
+        });
+        _test((searchParams) => {
+            expect(searchParams.get("identity_provider")).toBe(CognitoIdentityProvider.Apple);
+        }, CognitoIdentityProvider.Apple);
+    });
+});

package/lib/error.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Possible Authentications errors
+ */
+export declare enum AuthError {
+    /**
+     * User already confirmed
+     */
+    UserConfirmedAlready = "user_confirmed_already",
+    /**
+     * User Profile does not exists.
+     */
+    UserDoesNotExist = "user_does_not_exist",
+    /**
+     * User Profile does not exists.
+     */
+    UserAlreadyExists = "user_already_exists",
+    /**
+     * Password was wrong.
+     */
+    EmailOrPasswordWrong = "email_or_password_wrong",
+    /**
+     * Rate limit exceeded.
+     */
+    LimitExceededException = "limit_exceeded_exception",
+    /**
+     * User needs to be authenticated.
+     */
+    UserNotAuthenticated = "user_not_authenticated",
+    /**
+     * The user tried to many times wiht the wrong password
+     */
+    PasswordAttempsExceeded = "password_attemps_exceeded",
+    /**
+     * User E-Mail needs to be verified.
+     */
+    UserEmailNotVerified = "user_email_not_verified",
+    /**
+     * Unknown auth error happened.
+     */
+    Unknown = "unknown"
+}
+export declare class AuthException extends Error {
+    readonly authError: AuthError;
+    constructor(message: string, authError: AuthError);
+}
+export declare enum ErrorCode {
+    UserNotFoundException = "UserNotFoundException",
+    NotAuthorizedException = "NotAuthorizedException",
+    LimitExceededException = "LimitExceededException"
+}
+export interface CognitoAuthErrorResponse {
+    __type: ErrorCode;
+    message: string;
+}
+export declare function getAuthError(errorResponse: CognitoAuthErrorResponse): AuthException;

package/lib/error.js

@@ -0,0 +1,70 @@
+/**
+ * Possible Authentications errors
+ */
+export var AuthError;
+(function (AuthError) {
+    /**
+     * User already confirmed
+     */
+    AuthError["UserConfirmedAlready"] = "user_confirmed_already";
+    /**
+     * User Profile does not exists.
+     */
+    AuthError["UserDoesNotExist"] = "user_does_not_exist";
+    /**
+     * User Profile does not exists.
+     */
+    AuthError["UserAlreadyExists"] = "user_already_exists";
+    /**
+     * Password was wrong.
+     */
+    AuthError["EmailOrPasswordWrong"] = "email_or_password_wrong";
+    /**
+     * Rate limit exceeded.
+     */
+    AuthError["LimitExceededException"] = "limit_exceeded_exception";
+    /**
+     * User needs to be authenticated.
+     */
+    AuthError["UserNotAuthenticated"] = "user_not_authenticated";
+    /**
+     * The user tried to many times wiht the wrong password
+     */
+    AuthError["PasswordAttempsExceeded"] = "password_attemps_exceeded";
+    /**
+     * User E-Mail needs to be verified.
+     */
+    AuthError["UserEmailNotVerified"] = "user_email_not_verified";
+    /**
+     * Unknown auth error happened.
+     */
+    AuthError["Unknown"] = "unknown";
+})(AuthError || (AuthError = {}));
+export class AuthException extends Error {
+    constructor(message, authError) {
+        super(message);
+        this.authError = authError;
+    }
+}
+export var ErrorCode;
+(function (ErrorCode) {
+    ErrorCode["UserNotFoundException"] = "UserNotFoundException";
+    ErrorCode["NotAuthorizedException"] = "NotAuthorizedException";
+    ErrorCode["LimitExceededException"] = "LimitExceededException";
+})(ErrorCode || (ErrorCode = {}));
+export function getAuthError(errorResponse) {
+    const mapping = {
+        'UserNotFoundException:User cannot be confirmed. Current status is CONFIRMED': AuthError.UserConfirmedAlready,
+        'NotAuthorizedException:Incorrect username or password.': AuthError.EmailOrPasswordWrong,
+        'LimitExceededException:Attempt limit exceeded, please try after some time.': AuthError.LimitExceededException,
+        'UserNotFoundException:Username/client id combination not found.': AuthError.UserDoesNotExist,
+        'UserNotFoundException:User does not exist.': AuthError.UserDoesNotExist,
+        'NotAuthorizedException:Password attempts exceeded': AuthError.PasswordAttempsExceeded,
+        'UsernameExistsException:An account with the given email already exists.': AuthError.UserAlreadyExists,
+        'InvalidParameterException:Cannot reset password for the user as there is no registered/verified email or phone_number': AuthError.UserEmailNotVerified,
+        'UserNotConfirmedException:User is not confirmed.': AuthError.UserEmailNotVerified,
+    };
+    const message = `${errorResponse.__type}:${errorResponse.message}`;
+    const authError = mapping[message] || AuthError.Unknown;
+    return new AuthException(message, authError);
+}

package/lib/index.d.ts

@@ -0,0 +1,3 @@
+export * from './cognito-client.js';
+export * from './error.js';
+export * from './session-storage/index.js';

package/lib/index.js

@@ -0,0 +1,3 @@
+export * from './cognito-client.js';
+export * from './error.js';
+export * from './session-storage/index.js';

package/lib/session-storage/cookie-session-storage/cookie-session-storage.d.ts

@@ -0,0 +1,21 @@
+import { CookieProps } from '@vardario/cookies';
+import { Session } from '../../cognito-client.js';
+import { OAuthVerificationParams, SessionStorage } from '../session-storage.js';
+export interface CookieSessionStorageProps extends CookieProps {
+    cookieName: string;
+}
+/**
+ * Cookies based session storage.
+ * This session storage works also across sub domains.
+ */
+export declare class CookieSessionStorage extends SessionStorage {
+    private readonly props;
+    private readonly oAuthParamCookieName;
+    private readonly sessionCookieName;
+    private readonly cookies;
+    constructor(props: CookieSessionStorageProps);
+    getSession(): Session | undefined;
+    setSession(session: Session | undefined): void;
+    getOauthVerificationParams(): OAuthVerificationParams | undefined;
+    setOauthVerificationParams(oAuthParams: OAuthVerificationParams): void;
+}

package/lib/session-storage/cookie-session-storage/cookie-session-storage.js

@@ -0,0 +1,42 @@
+import { Cookies } from '@vardario/cookies';
+import { SessionStorage } from '../session-storage.js';
+/**
+ * Cookies based session storage.
+ * This session storage works also across sub domains.
+ */
+export class CookieSessionStorage extends SessionStorage {
+    constructor(props) {
+        super();
+        this.props = {
+            domain: props.domain,
+            path: props.path ?? '/',
+            expires: props.expires ?? 365,
+            secure: props.secure ?? true,
+            sameSite: props.sameSite ?? 'None',
+            cookieName: props.cookieName,
+        };
+        this.cookies = new Cookies(this.props);
+        this.sessionCookieName = `${props.cookieName}`;
+        this.oAuthParamCookieName = `${props.cookieName}_oauth`;
+    }
+    getSession() {
+        const session = this.cookies.getCookie(this.sessionCookieName);
+        if (session === undefined) {
+            return undefined;
+        }
+        return JSON.parse(session);
+    }
+    setSession(session) {
+        this.cookies.setCookie(this.sessionCookieName, JSON.stringify(session));
+    }
+    getOauthVerificationParams() {
+        const oAuthParams = this.cookies.getCookie(this.oAuthParamCookieName);
+        if (oAuthParams === undefined) {
+            return undefined;
+        }
+        return JSON.parse(oAuthParams);
+    }
+    setOauthVerificationParams(oAuthParams) {
+        this.cookies.setCookie(this.oAuthParamCookieName, JSON.stringify(oAuthParams));
+    }
+}

package/lib/session-storage/cookie-session-storage/index.d.ts

@@ -0,0 +1 @@
+export * from './cookie-session-storage.js';

package/lib/session-storage/cookie-session-storage/index.js

@@ -0,0 +1 @@
+export * from './cookie-session-storage.js';

package/lib/session-storage/index.d.ts

@@ -0,0 +1,4 @@
+export * from './cookie-session-storage/index.js';
+export * from './local-storage-session-storage.js';
+export * from './memory-session-storage.js';
+export * from './session-storage.js';

package/lib/session-storage/index.js

@@ -0,0 +1,4 @@
+export * from './cookie-session-storage/index.js';
+export * from './local-storage-session-storage.js';
+export * from './memory-session-storage.js';
+export * from './session-storage.js';

package/lib/session-storage/local-storage-session-storage.d.ts

@@ -0,0 +1,20 @@
+import { Session } from '../cognito-client.js';
+import { OAuthVerificationParams, SessionStorage } from './session-storage.js';
+export interface LocalStorageSessionStorageProps {
+    storageName: string;
+}
+/**
+ * LocalStorage based session storage.
+ * This session storage works only one domain at a time.
+ * @see https://developer.mozilla.org/en-US/docs/Web/API/Window/localStorage
+ * Use @see CookieSessionStorage for a session storage, which
+ * can span across sub domains as well.
+ */
+export declare class LocalStorageSessionStorage extends SessionStorage {
+    private readonly props;
+    constructor(props: LocalStorageSessionStorageProps);
+    getSession(): Session | undefined;
+    setSession(session: Session | undefined): void;
+    setOauthVerificationParams(oAuthParams: OAuthVerificationParams): void;
+    getOauthVerificationParams(): OAuthVerificationParams | undefined;
+}

package/lib/session-storage/local-storage-session-storage.js

@@ -0,0 +1,38 @@
+import { SessionStorage } from './session-storage.js';
+/**
+ * LocalStorage based session storage.
+ * This session storage works only one domain at a time.
+ * @see https://developer.mozilla.org/en-US/docs/Web/API/Window/localStorage
+ * Use @see CookieSessionStorage for a session storage, which
+ * can span across sub domains as well.
+ */
+export class LocalStorageSessionStorage extends SessionStorage {
+    constructor(props) {
+        super();
+        this.props = props;
+    }
+    getSession() {
+        const payload = window.localStorage.getItem(this.props.storageName);
+        if (payload === null) {
+            return undefined;
+        }
+        return JSON.parse(payload);
+    }
+    setSession(session) {
+        if (session === undefined) {
+            window.localStorage.removeItem(this.props.storageName);
+            return;
+        }
+        window.localStorage.setItem(this.props.storageName, JSON.stringify(session));
+    }
+    setOauthVerificationParams(oAuthParams) {
+        window.localStorage.setItem(`${this.props.storageName}_oauth`, JSON.stringify(oAuthParams));
+    }
+    getOauthVerificationParams() {
+        const payload = window.localStorage.getItem(`${this.props.storageName}_oauth`);
+        if (payload === null) {
+            return undefined;
+        }
+        return JSON.parse(payload);
+    }
+}

package/lib/session-storage/memory-session-storage.d.ts

@@ -0,0 +1,13 @@
+import { Session } from '../cognito-client.js';
+import { OAuthVerificationParams, SessionStorage } from './session-storage.js';
+/**
+ * In-memory based session storage. Useful for testing.
+ */
+export declare class MemorySessionStorage extends SessionStorage {
+    private session?;
+    private oAuthVerificationParams?;
+    getSession(): Session | undefined;
+    setSession(session: Session | undefined): void;
+    getOauthVerificationParams(): OAuthVerificationParams | undefined;
+    setOauthVerificationParams(oAuthParams: OAuthVerificationParams): void;
+}

package/lib/session-storage/memory-session-storage.js

@@ -0,0 +1,18 @@
+import { SessionStorage } from './session-storage.js';
+/**
+ * In-memory based session storage. Useful for testing.
+ */
+export class MemorySessionStorage extends SessionStorage {
+    getSession() {
+        return this.session;
+    }
+    setSession(session) {
+        this.session = session;
+    }
+    getOauthVerificationParams() {
+        return this.oAuthVerificationParams;
+    }
+    setOauthVerificationParams(oAuthParams) {
+        this.oAuthVerificationParams = oAuthParams;
+    }
+}

package/lib/session-storage/session-storage.d.ts

@@ -0,0 +1,14 @@
+import { Session } from '../cognito-client.js';
+export interface OAuthVerificationParams {
+    pkce: string;
+    state: string;
+}
+/**
+ * Session storage interface class.
+ */
+export declare abstract class SessionStorage {
+    abstract getSession(): Session | undefined;
+    abstract setSession(session: Session | undefined): void;
+    abstract setOauthVerificationParams(oAuthParams: OAuthVerificationParams): void;
+    abstract getOauthVerificationParams(): OAuthVerificationParams | undefined;
+}

package/lib/session-storage/session-storage.js

@@ -0,0 +1,5 @@
+/**
+ * Session storage interface class.
+ */
+export class SessionStorage {
+}

package/lib/session-storage/session-storage.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/session-storage/session-storage.test.js

@@ -0,0 +1,33 @@
+import { randomBytes } from "crypto";
+import { setupJsDom } from "../test-utils.js";
+import { CookieSessionStorage } from "./cookie-session-storage/index.js";
+import { LocalStorageSessionStorage } from "./local-storage-session-storage.js";
+import { MemorySessionStorage } from "./memory-session-storage.js";
+import { expect, test } from "vitest";
+setupJsDom();
+const sessionStorages = [
+    new MemorySessionStorage(),
+    new LocalStorageSessionStorage({ storageName: "session" }),
+    new CookieSessionStorage({
+        domain: "localhost",
+        cookieName: "session",
+    }),
+];
+const session = {
+    accessToken: randomBytes(128).toString("base64"),
+    expiresIn: 600,
+    idToken: randomBytes(128).toString("base64"),
+    refreshToken: randomBytes(128).toString("base64"),
+};
+const oAuthVerificationParams = {
+    pkce: randomBytes(128).toString("base64"),
+    state: randomBytes(128).toString("base64"),
+};
+test("SessionStorage", () => {
+    sessionStorages.forEach((sessionStorage) => {
+        sessionStorage.setSession(session);
+        expect(sessionStorage.getSession()).toStrictEqual(session);
+        sessionStorage.setOauthVerificationParams(oAuthVerificationParams);
+        expect(sessionStorage.getOauthVerificationParams()).toStrictEqual(oAuthVerificationParams);
+    });
+});

package/lib/test-utils.d.ts

@@ -0,0 +1,17 @@
+export declare const user: {
+    email: string;
+    password: string;
+    givenName: string;
+    familyName: string;
+};
+export declare const newUser: {
+    email: string;
+    password: string;
+    givenName: string;
+    familyName: string;
+};
+export declare function setupCognito(endpoint: string): Promise<{
+    userPoolId: string;
+    userPoolClientId: string;
+}>;
+export declare function setupJsDom(): void;

package/lib/test-utils.js

@@ -0,0 +1,81 @@
+const { AdminCreateUserCommand, AdminSetUserPasswordCommand, AttributeDataType, CognitoIdentityProviderClient, CreateUserPoolClientCommand, CreateUserPoolCommand, } = await import("@aws-sdk/client-cognito-identity-provider");
+import { JSDOM } from "jsdom";
+export const user = {
+    email: "sahin@test.com",
+    password: "password",
+    givenName: "Sahin",
+    familyName: "Sahin",
+};
+export const newUser = {
+    email: "john@test.com",
+    password: "password",
+    givenName: "John",
+    familyName: "John",
+};
+export async function setupCognito(endpoint) {
+    const awsCognitoClient = new CognitoIdentityProviderClient({
+        endpoint: endpoint,
+        credentials: {
+            accessKeyId: "test",
+            secretAccessKey: "test",
+        },
+        region: "eu-central-1",
+    });
+    const createPoolResult = await awsCognitoClient.send(new CreateUserPoolCommand({
+        PoolName: "TestPool",
+        Schema: [
+            {
+                Name: "email",
+                AttributeDataType: AttributeDataType.STRING,
+                Required: true,
+            },
+            {
+                Name: "givenName",
+                AttributeDataType: AttributeDataType.STRING,
+                Required: true,
+            },
+            {
+                Name: "familyName",
+                AttributeDataType: AttributeDataType.STRING,
+                Required: true,
+            },
+        ],
+    }));
+    const createUserPoolClientResult = await awsCognitoClient.send(new CreateUserPoolClientCommand({
+        ClientName: "TestClient",
+        UserPoolId: createPoolResult.UserPool?.Id,
+    }));
+    const createUserResult = await awsCognitoClient.send(new AdminCreateUserCommand({
+        UserPoolId: createPoolResult.UserPool?.Id,
+        Username: user.email,
+        MessageAction: "SUPPRESS",
+        UserAttributes: [
+            {
+                Name: "givenName",
+                Value: user.givenName,
+            },
+            {
+                Name: "familyName",
+                Value: user.familyName,
+            },
+        ],
+    }));
+    const setUserPasswordResult = await awsCognitoClient.send(new AdminSetUserPasswordCommand({
+        UserPoolId: createPoolResult.UserPool?.Id,
+        Username: user.email,
+        Password: user.password,
+        Permanent: true,
+    }));
+    return {
+        userPoolId: createPoolResult.UserPool?.Id,
+        userPoolClientId: createUserPoolClientResult.UserPoolClient
+            ?.ClientId,
+    };
+}
+export function setupJsDom() {
+    const dom = new JSDOM("", {
+        url: "http://localhost",
+    });
+    global.document = dom.window.document;
+    global.window = dom.window;
+}

package/lib/utils.d.ts

@@ -0,0 +1,20 @@
+/// <reference types="node" resolution-mode="require"/>
+import { BigInteger } from 'jsbn';
+export declare function padHex(bigInt: BigInteger): string;
+export declare function hashHexString(str: string): string;
+export declare function hashBuffer(buffer: Buffer): string;
+export declare function generateSmallA(): BigInteger;
+export declare function generateA(smallA: BigInteger): BigInteger;
+export declare function calculateU(A: BigInteger, B: BigInteger): BigInteger;
+export declare function calculateS(X: BigInteger, B: BigInteger, U: BigInteger, smallA: BigInteger): BigInteger;
+export declare function calculateHKDF(ikm: Buffer, salt: Buffer): number[];
+export declare function getPasswordAuthenticationKey(poolName: string, username: string, password: string, B: BigInteger, U: BigInteger, smallA: BigInteger, salt: BigInteger): number[];
+export declare function calculateSignature(poolName: string, userId: string, secretBlock: string, hkdf: number[]): {
+    signature: string;
+    timeStamp: any;
+};
+export declare function decodeJwt<T = unknown>(jwt: string): {
+    header: any;
+    payload: T;
+    signature: string;
+};