@vardario/cognito-client 1.0.0 → 2.0.0

package/README.md

@@ -1,3 +1,4 @@
 # Cognito Client
 
 A lightweight cognito client implementation which support SRP authentication.
+Works in node and the browser.

package/lib/cognito-client.d.ts

@@ -134,7 +134,6 @@ export interface AuthenticationResult {
     AccessToken: string;
     ExpiresIn: number;
     IdToken: string;
-    TokenType: string;
     RefreshToken: string;
 }
 export interface AuthenticationResponse {
@@ -150,6 +149,8 @@ export interface ChallengeResponse {
         USER_ID_FOR_SRP: string;
     };
 }
+export declare function authResultToSession(authenticationResult: AuthenticationResult): Session;
+export declare function cognitoRequest(body: object, serviceTarget: CognitoServiceTarget, cognitoEndpoint: string): Promise<any>;
 /**
  * Lightweight AWS Cogito client without any AWS SDK dependencies.
  */
@@ -160,8 +161,6 @@ export declare class CognitoClient {
     private readonly oAuth?;
     constructor({ userPoolId, userPoolClientId, endpoint, oAuth2: oAuth }: CognitoClientProps);
     static getDecodedTokenFromSession(session: Session): DecodedTokens;
-    private cognitoRequest;
-    private static authResultToSession;
     /**
      *
      * Performs user authentication with username and password through ALLOW_USER_SRP_AUTH .
@@ -169,7 +168,8 @@ export declare class CognitoClient {
      *
      * @param username Username
      * @param password Password
-     * @throws {CognitoException}
+     *
+     * @throws {InitiateAuthException}
      */
     authenticateUserSrp(username: string, password: string): Promise<Session>;
     /**
@@ -179,7 +179,7 @@ export declare class CognitoClient {
      *
      * @param username Username
      * @param password Password
-     * @throws {CognitoException}
+     * @throws {InitiateAuthException}
      */
     authenticateUser(username: string, password: string): Promise<Session>;
     /**
@@ -187,7 +187,7 @@ export declare class CognitoClient {
      *
      * @param refreshToken
      * @returns @see Session
-     * @throws {CognitoError}
+     * @throws {InitiateAuthException}
      */
     refreshSession(refreshToken: string): Promise<Session>;
     /**
@@ -195,7 +195,7 @@ export declare class CognitoClient {
      * @param username Username
      * @param password Password
      *
-     * @throws {CognitoException}
+     * @throws {SignUpException}
      */
     signUp(username: string, password: string, userAttributes?: UserAttribute[]): Promise<{
         id: string;
@@ -207,7 +207,7 @@ export declare class CognitoClient {
      * @param username Username
      * @param code Confirmation code the user gets through the registration E-Mail
      *
-     * @throws {CognitoException}
+     * @throws {ConfirmSignUpException}
      */
     confirmSignUp(username: string, code: string): Promise<void>;
     /**
@@ -215,22 +215,39 @@ export declare class CognitoClient {
      * @param currentPassword Current user password.
      * @param newPassword  New user password.
      *
-     * @throws {CognitoException}
+     * @throws {ChangePasswordException}
      */
     changePassword(currentPassword: string, newPassword: string, accessToken: string): Promise<void>;
+    /**
+     * Updates the user attributes.
+     *
+     * @param userAttributes List of user attributes to update.
+     * @param accessToken Access token of the current user.
+     *
+     * @throws {UpdateUserAttributesException}
+     */
     updateUserAttributes(userAttributes: UserAttribute[], accessToken: string): Promise<void>;
+    /**
+     * Verifies a given user attribute
+     *
+     * @param attributeName Name of the attribute to verify
+     * @param code  Verification code
+     * @param accessToken Access token of the current user.
+     *
+     * @throws {VerifyUserAttributeException}
+     */
     verifyUserAttribute(attributeName: string, code: string, accessToken: string): Promise<void>;
     /**
      * Sign out the user and remove the current user session.
      *
-     * @throws {CognitoException}
+     * @throws {RevokeTokenException}
      */
     signOut(refreshToken: string): Promise<void>;
     /**
      * Request forgot password.
      * @param username Username
      *
-     * @throws {CognitoException}
+     * @throws {ForgotPasswordException}
      */
     forgotPassword(username: string): Promise<void>;
     /**
@@ -240,12 +257,14 @@ export declare class CognitoClient {
      * @param newPassword New password
      * @param confirmationCode Confirmation code which the user got through E-mail
      *
-     * @throws {CognitoException}
+     * @throws {ConfirmForgotPasswordException}
      */
     confirmForgotPassword(username: string, newPassword: string, confirmationCode: string): Promise<void>;
     /**
      * Triggers cognito to resend the confirmation code
      * @param username Username
+     *
+     * @throws {ResendConfirmationCodeException}
      */
     resendConfirmationCode(username: string): Promise<void>;
     /**

package/lib/cognito-client.js

@@ -1,7 +1,7 @@
 import hashJs from 'hash.js';
 import { BigInteger } from 'jsbn';
 import { Buffer } from 'buffer';
-import { CognitoError, CognitoException } from './error.js';
+import { CognitoCommonException, CognitoError } from './error.js';
 import { calculateSignature, calculateU, decodeJwt, generateA, generateSmallA, getPasswordAuthenticationKey, randomBytes } from './utils.js';
 /**
  * List of used and supported Cognito API calls.
@@ -33,6 +33,48 @@ export var CognitoIdentityProvider;
     CognitoIdentityProvider["Amazon"] = "LoginWithAmazon";
     CognitoIdentityProvider["Apple"] = "SignInWithApple";
 })(CognitoIdentityProvider || (CognitoIdentityProvider = {}));
+export function authResultToSession(authenticationResult) {
+    return {
+        accessToken: authenticationResult.AccessToken,
+        idToken: authenticationResult.IdToken,
+        expiresIn: new Date().getTime() + authenticationResult.ExpiresIn * 1000,
+        refreshToken: authenticationResult.RefreshToken
+    };
+}
+export async function cognitoRequest(body, serviceTarget, cognitoEndpoint) {
+    const cognitoResponse = await fetch(cognitoEndpoint, {
+        headers: {
+            'x-amz-target': `AWSCognitoIdentityProviderService.${serviceTarget}`,
+            'content-type': 'application/x-amz-json-1.1'
+        },
+        method: 'POST',
+        body: JSON.stringify(body)
+    });
+    if (cognitoResponse && cognitoResponse.status < 300) {
+        return cognitoResponse.json();
+    }
+    const cognitoResponseBody = await cognitoResponse.json();
+    /**
+     * The whole error handling and value sanitization was inspired
+     * by @see https://github.com/aws-amplify/amplify-js/blob/1f5eefd9c40285eb99e57764ac8fca1f9519e2c6/packages/core/src/clients/serde/json.ts#L14
+     */
+    const sanitizeErrorType = (rawValue) => {
+        const [cleanValue] = rawValue.toString().split(/[,:]+/);
+        if (cleanValue.includes('#')) {
+            return cleanValue.split('#')[1];
+        }
+        return cleanValue;
+    };
+    const errorMessage = cognitoResponse.headers.get('X-Amzn-ErrorMessage') ??
+        cognitoResponseBody.message ??
+        cognitoResponseBody.Message ??
+        'Unknown error';
+    const cognitoException = sanitizeErrorType(cognitoResponse.headers.get('X-Amzn-ErrorType') ??
+        cognitoResponseBody.code ??
+        cognitoResponseBody.__type ??
+        CognitoCommonException.Unknown);
+    throw new CognitoError(errorMessage, cognitoException);
+}
 /**
  * Lightweight AWS Cogito client without any AWS SDK dependencies.
  */
@@ -52,30 +94,6 @@ export class CognitoClient {
             accessToken
         };
     }
-    async cognitoRequest(body, serviceTarget) {
-        const cognitoResponse = await fetch(this.cognitoEndpoint, {
-            headers: {
-                'x-amz-target': `AWSCognitoIdentityProviderService.${serviceTarget}`,
-                'content-type': 'application/x-amz-json-1.1'
-            },
-            method: 'POST',
-            body: JSON.stringify(body)
-        });
-        if (cognitoResponse.status < 200 || cognitoResponse.status > 299) {
-            const errorMessage = cognitoResponse.headers.get('X-Amzn-ErrorMessage') ?? 'Unknown';
-            const cognitoException = cognitoResponse.headers.get('X-Amzn-ErrorType') ?? CognitoException.Unknown;
-            throw new CognitoError(errorMessage, cognitoException);
-        }
-        return cognitoResponse.json();
-    }
-    static authResultToSession(authenticationResult) {
-        return {
-            accessToken: authenticationResult.AccessToken,
-            idToken: authenticationResult.IdToken,
-            expiresIn: new Date().getMilliseconds() / 1000 + authenticationResult.ExpiresIn,
-            refreshToken: authenticationResult.RefreshToken
-        };
-    }
     /**
      *
      * Performs user authentication with username and password through ALLOW_USER_SRP_AUTH .
@@ -83,7 +101,8 @@ export class CognitoClient {
      *
      * @param username Username
      * @param password Password
-     * @throws {CognitoException}
+     *
+     * @throws {InitiateAuthException}
      */
     async authenticateUserSrp(username, password) {
         const smallA = await generateSmallA();
@@ -97,7 +116,7 @@ export class CognitoClient {
             },
             ClientMetadata: {}
         };
-        const challenge = (await this.cognitoRequest(initiateAuthPayload, CognitoServiceTarget.InitiateAuth));
+        const challenge = (await cognitoRequest(initiateAuthPayload, CognitoServiceTarget.InitiateAuth, this.cognitoEndpoint));
         const B = new BigInteger(challenge.ChallengeParameters.SRP_B, 16);
         const salt = new BigInteger(challenge.ChallengeParameters.SALT, 16);
         const U = calculateU(A, B);
@@ -114,8 +133,8 @@ export class CognitoClient {
             },
             ClientMetadata: {}
         };
-        const { AuthenticationResult } = await this.cognitoRequest(respondToAuthChallengePayload, CognitoServiceTarget.RespondToAuthChallenge);
-        return CognitoClient.authResultToSession(AuthenticationResult);
+        const { AuthenticationResult } = await cognitoRequest(respondToAuthChallengePayload, CognitoServiceTarget.RespondToAuthChallenge, this.cognitoEndpoint);
+        return authResultToSession(AuthenticationResult);
     }
     /**
      *
@@ -124,7 +143,7 @@ export class CognitoClient {
      *
      * @param username Username
      * @param password Password
-     * @throws {CognitoException}
+     * @throws {InitiateAuthException}
      */
     async authenticateUser(username, password) {
         const initiateAuthPayload = {
@@ -136,8 +155,8 @@ export class CognitoClient {
             },
             ClientMetadata: {}
         };
-        const { AuthenticationResult } = (await this.cognitoRequest(initiateAuthPayload, CognitoServiceTarget.InitiateAuth));
-        const session = CognitoClient.authResultToSession(AuthenticationResult);
+        const { AuthenticationResult } = (await cognitoRequest(initiateAuthPayload, CognitoServiceTarget.InitiateAuth, this.cognitoEndpoint));
+        const session = authResultToSession(AuthenticationResult);
         return session;
     }
     /**
@@ -145,7 +164,7 @@ export class CognitoClient {
      *
      * @param refreshToken
      * @returns @see Session
-     * @throws {CognitoError}
+     * @throws {InitiateAuthException}
      */
     async refreshSession(refreshToken) {
         const refreshTokenPayload = {
@@ -156,18 +175,18 @@ export class CognitoClient {
             },
             ClientMetadata: {}
         };
-        const { AuthenticationResult } = (await this.cognitoRequest(refreshTokenPayload, CognitoServiceTarget.InitiateAuth));
+        const { AuthenticationResult } = (await cognitoRequest(refreshTokenPayload, CognitoServiceTarget.InitiateAuth, this.cognitoEndpoint));
         if (!AuthenticationResult.RefreshToken) {
             AuthenticationResult.RefreshToken = refreshToken;
         }
-        return CognitoClient.authResultToSession(AuthenticationResult);
+        return authResultToSession(AuthenticationResult);
     }
     /**
      *
      * @param username Username
      * @param password Password
      *
-     * @throws {CognitoException}
+     * @throws {SignUpException}
      */
     async signUp(username, password, userAttributes) {
         const signUpPayload = {
@@ -176,7 +195,7 @@ export class CognitoClient {
             Password: password,
             UserAttributes: userAttributes
         };
-        const data = await this.cognitoRequest(signUpPayload, CognitoServiceTarget.SignUp);
+        const data = await cognitoRequest(signUpPayload, CognitoServiceTarget.SignUp, this.cognitoEndpoint);
         return {
             id: data.UserSub,
             confirmed: data.UserConfirmed
@@ -188,7 +207,7 @@ export class CognitoClient {
      * @param username Username
      * @param code Confirmation code the user gets through the registration E-Mail
      *
-     * @throws {CognitoException}
+     * @throws {ConfirmSignUpException}
      */
     async confirmSignUp(username, code) {
         const confirmSignUpPayload = {
@@ -196,14 +215,14 @@ export class CognitoClient {
             ConfirmationCode: code,
             Username: username
         };
-        await this.cognitoRequest(confirmSignUpPayload, CognitoServiceTarget.ConfirmSignUp);
+        await cognitoRequest(confirmSignUpPayload, CognitoServiceTarget.ConfirmSignUp, this.cognitoEndpoint);
     }
     /**
      *
      * @param currentPassword Current user password.
      * @param newPassword  New user password.
      *
-     * @throws {CognitoException}
+     * @throws {ChangePasswordException}
      */
     async changePassword(currentPassword, newPassword, accessToken) {
         const changePasswordPayload = {
@@ -211,47 +230,64 @@ export class CognitoClient {
             ProposedPassword: newPassword,
             AccessToken: accessToken
         };
-        await this.cognitoRequest(changePasswordPayload, CognitoServiceTarget.ChangePassword);
+        await cognitoRequest(changePasswordPayload, CognitoServiceTarget.ChangePassword, this.cognitoEndpoint);
     }
+    /**
+     * Updates the user attributes.
+     *
+     * @param userAttributes List of user attributes to update.
+     * @param accessToken Access token of the current user.
+     *
+     * @throws {UpdateUserAttributesException}
+     */
     async updateUserAttributes(userAttributes, accessToken) {
         const updateUserAttributesPayload = {
             UserAttributes: userAttributes,
             AccessToken: accessToken
         };
-        await this.cognitoRequest(updateUserAttributesPayload, CognitoServiceTarget.UpdateUserAttributes);
+        await cognitoRequest(updateUserAttributesPayload, CognitoServiceTarget.UpdateUserAttributes, this.cognitoEndpoint);
     }
+    /**
+     * Verifies a given user attribute
+     *
+     * @param attributeName Name of the attribute to verify
+     * @param code  Verification code
+     * @param accessToken Access token of the current user.
+     *
+     * @throws {VerifyUserAttributeException}
+     */
     async verifyUserAttribute(attributeName, code, accessToken) {
         const verifyUserAttributePayload = {
             AttributeName: attributeName,
             Code: code,
             AccessToken: accessToken
         };
-        await this.cognitoRequest(verifyUserAttributePayload, CognitoServiceTarget.VerifyUserAttribute);
+        await cognitoRequest(verifyUserAttributePayload, CognitoServiceTarget.VerifyUserAttribute, this.cognitoEndpoint);
     }
     /**
      * Sign out the user and remove the current user session.
      *
-     * @throws {CognitoException}
+     * @throws {RevokeTokenException}
      */
     async signOut(refreshToken) {
         const revokeTokenPayload = {
             Token: refreshToken,
             ClientId: this.userPoolClientId
         };
-        await this.cognitoRequest(revokeTokenPayload, CognitoServiceTarget.RevokeToken);
+        await cognitoRequest(revokeTokenPayload, CognitoServiceTarget.RevokeToken, this.cognitoEndpoint);
     }
     /**
      * Request forgot password.
      * @param username Username
      *
-     * @throws {CognitoException}
+     * @throws {ForgotPasswordException}
      */
     async forgotPassword(username) {
         const forgotPasswordPayload = {
             ClientId: this.userPoolClientId,
             Username: username
         };
-        await this.cognitoRequest(forgotPasswordPayload, CognitoServiceTarget.ForgotPassword);
+        await cognitoRequest(forgotPasswordPayload, CognitoServiceTarget.ForgotPassword, this.cognitoEndpoint);
     }
     /**
      * Confirms the new password via the given code send via cognito triggered by @see forgotPassword .
@@ -260,7 +296,7 @@ export class CognitoClient {
      * @param newPassword New password
      * @param confirmationCode Confirmation code which the user got through E-mail
      *
-     * @throws {CognitoException}
+     * @throws {ConfirmForgotPasswordException}
      */
     async confirmForgotPassword(username, newPassword, confirmationCode) {
         const confirmForgotPasswordPayload = {
@@ -269,18 +305,20 @@ export class CognitoClient {
             ConfirmationCode: confirmationCode,
             Password: newPassword
         };
-        await this.cognitoRequest(confirmForgotPasswordPayload, CognitoServiceTarget.ConfirmForgotPassword);
+        await cognitoRequest(confirmForgotPasswordPayload, CognitoServiceTarget.ConfirmForgotPassword, this.cognitoEndpoint);
     }
     /**
      * Triggers cognito to resend the confirmation code
      * @param username Username
+     *
+     * @throws {ResendConfirmationCodeException}
      */
     async resendConfirmationCode(username) {
         const resendConfirmationCodePayLoad = {
             ClientId: this.userPoolClientId,
             Username: username
         };
-        await this.cognitoRequest(resendConfirmationCodePayLoad, CognitoServiceTarget.ResendConfirmationCode);
+        await cognitoRequest(resendConfirmationCodePayLoad, CognitoServiceTarget.ResendConfirmationCode, this.cognitoEndpoint);
     }
     /**
      * Returns a link to Cognito`s Hosted UI for OAuth2 authentication.
@@ -352,16 +390,15 @@ export class CognitoClient {
             },
             body: urlParams.toString()
         });
-        const { access_token, refresh_token, id_token, expires_in, token_type, error } = await response.json();
+        const { access_token, refresh_token, id_token, expires_in, error } = await response.json();
         if (error) {
             throw new Error(error);
         }
-        const session = CognitoClient.authResultToSession({
+        const session = authResultToSession({
             AccessToken: access_token,
             RefreshToken: refresh_token,
             IdToken: id_token,
-            ExpiresIn: expires_in,
-            TokenType: token_type
+            ExpiresIn: expires_in
         });
         return session;
     }