@vardario/cognito-client 4.0.6 → 5.0.0

package/lib/browser.js

@@ -223,23 +223,23 @@ var GlobalSignOutException = /* @__PURE__ */ ((GlobalSignOutException3) => {
   GlobalSignOutException3["UserNotConfirmedException"] = "UserNotConfirmedException";
   return GlobalSignOutException3;
 })(GlobalSignOutException || {});
-var InitiateAuthException = /* @__PURE__ */ ((InitiateAuthException3) => {
-  InitiateAuthException3["PasswordResetRequiredException"] = "PasswordResetRequiredException";
-  InitiateAuthException3["ForbiddenException"] = "ForbiddenException";
-  InitiateAuthException3["InternalErrorException"] = "InternalErrorException";
-  InitiateAuthException3["InvalidLambdaResponseException"] = "InvalidLambdaResponseException";
-  InitiateAuthException3["InvalidParameterException"] = "InvalidParameterException";
-  InitiateAuthException3["InvalidSmsRoleAccessPolicyException"] = "InvalidSmsRoleAccessPolicyException";
-  InitiateAuthException3["InvalidSmsRoleTrustRelationshipException"] = "InvalidSmsRoleTrustRelationshipException";
-  InitiateAuthException3["InvalidUserPoolConfigurationException"] = "InvalidUserPoolConfigurationException";
-  InitiateAuthException3["NotAuthorizedException"] = "NotAuthorizedException";
-  InitiateAuthException3["ResourceNotFoundException"] = "ResourceNotFoundException";
-  InitiateAuthException3["TooManyRequestsException"] = "TooManyRequestsException";
-  InitiateAuthException3["UnexpectedLambdaException"] = "UnexpectedLambdaException";
-  InitiateAuthException3["UserLambdaValidationException"] = "UserLambdaValidationException";
-  InitiateAuthException3["UserNotConfirmedException"] = "UserNotConfirmedException";
-  InitiateAuthException3["UserNotFoundException"] = "UserNotFoundException";
-  return InitiateAuthException3;
+var InitiateAuthException = /* @__PURE__ */ ((InitiateAuthException2) => {
+  InitiateAuthException2["PasswordResetRequiredException"] = "PasswordResetRequiredException";
+  InitiateAuthException2["ForbiddenException"] = "ForbiddenException";
+  InitiateAuthException2["InternalErrorException"] = "InternalErrorException";
+  InitiateAuthException2["InvalidLambdaResponseException"] = "InvalidLambdaResponseException";
+  InitiateAuthException2["InvalidParameterException"] = "InvalidParameterException";
+  InitiateAuthException2["InvalidSmsRoleAccessPolicyException"] = "InvalidSmsRoleAccessPolicyException";
+  InitiateAuthException2["InvalidSmsRoleTrustRelationshipException"] = "InvalidSmsRoleTrustRelationshipException";
+  InitiateAuthException2["InvalidUserPoolConfigurationException"] = "InvalidUserPoolConfigurationException";
+  InitiateAuthException2["NotAuthorizedException"] = "NotAuthorizedException";
+  InitiateAuthException2["ResourceNotFoundException"] = "ResourceNotFoundException";
+  InitiateAuthException2["TooManyRequestsException"] = "TooManyRequestsException";
+  InitiateAuthException2["UnexpectedLambdaException"] = "UnexpectedLambdaException";
+  InitiateAuthException2["UserLambdaValidationException"] = "UserLambdaValidationException";
+  InitiateAuthException2["UserNotConfirmedException"] = "UserNotConfirmedException";
+  InitiateAuthException2["UserNotFoundException"] = "UserNotFoundException";
+  return InitiateAuthException2;
 })(InitiateAuthException || {});
 var ResendConfirmationException = /* @__PURE__ */ ((ResendConfirmationException3) => {
   ResendConfirmationException3["CodeDeliveryFailureException"] = "CodeDeliveryFailureException";
@@ -333,21 +333,21 @@ var UpdateUserAttributesException = /* @__PURE__ */ ((UpdateUserAttributesExcept
   UpdateUserAttributesException3["UserNotFoundException"] = "UserNotFoundException";
   return UpdateUserAttributesException3;
 })(UpdateUserAttributesException || {});
-var VerifySoftwareTokenException = /* @__PURE__ */ ((VerifySoftwareTokenException2) => {
-  VerifySoftwareTokenException2["CodeMismatchException"] = "CodeMismatchException";
-  VerifySoftwareTokenException2["EnableSoftwareTokenMFAException"] = "EnableSoftwareTokenMFAException";
-  VerifySoftwareTokenException2["ForbiddenException"] = "ForbiddenException";
-  VerifySoftwareTokenException2["InternalErrorException"] = "InternalErrorException";
-  VerifySoftwareTokenException2["InvalidParameterException"] = "InvalidParameterException";
-  VerifySoftwareTokenException2["InvalidUserPoolConfigurationException"] = "InvalidUserPoolConfigurationException";
-  VerifySoftwareTokenException2["NotAuthorizedException"] = "NotAuthorizedException";
-  VerifySoftwareTokenException2["PasswordResetRequiredException"] = "PasswordResetRequiredException";
-  VerifySoftwareTokenException2["ResourceNotFoundException"] = "ResourceNotFoundException";
-  VerifySoftwareTokenException2["SoftwareTokenMFANotFoundException"] = "SoftwareTokenMFANotFoundException";
-  VerifySoftwareTokenException2["TooManyRequestsException"] = "TooManyRequestsException";
-  VerifySoftwareTokenException2["UserNotConfirmedException"] = "UserNotConfirmedException";
-  VerifySoftwareTokenException2["UserNotFoundException"] = "UserNotFoundException";
-  return VerifySoftwareTokenException2;
+var VerifySoftwareTokenException = /* @__PURE__ */ ((VerifySoftwareTokenException3) => {
+  VerifySoftwareTokenException3["CodeMismatchException"] = "CodeMismatchException";
+  VerifySoftwareTokenException3["EnableSoftwareTokenMFAException"] = "EnableSoftwareTokenMFAException";
+  VerifySoftwareTokenException3["ForbiddenException"] = "ForbiddenException";
+  VerifySoftwareTokenException3["InternalErrorException"] = "InternalErrorException";
+  VerifySoftwareTokenException3["InvalidParameterException"] = "InvalidParameterException";
+  VerifySoftwareTokenException3["InvalidUserPoolConfigurationException"] = "InvalidUserPoolConfigurationException";
+  VerifySoftwareTokenException3["NotAuthorizedException"] = "NotAuthorizedException";
+  VerifySoftwareTokenException3["PasswordResetRequiredException"] = "PasswordResetRequiredException";
+  VerifySoftwareTokenException3["ResourceNotFoundException"] = "ResourceNotFoundException";
+  VerifySoftwareTokenException3["SoftwareTokenMFANotFoundException"] = "SoftwareTokenMFANotFoundException";
+  VerifySoftwareTokenException3["TooManyRequestsException"] = "TooManyRequestsException";
+  VerifySoftwareTokenException3["UserNotConfirmedException"] = "UserNotConfirmedException";
+  VerifySoftwareTokenException3["UserNotFoundException"] = "UserNotFoundException";
+  return VerifySoftwareTokenException3;
 })(VerifySoftwareTokenException || {});
 var VerifyUserAttributeException = /* @__PURE__ */ ((VerifyUserAttributeException3) => {
   VerifyUserAttributeException3["AliasExistsException"] = "AliasExistsException";
@@ -486,16 +486,25 @@ var GlobalSignOutError = class extends CognitoError {
     this.cognitoException = cognitoException;
   }
 };
+var VerifySoftwareTokenError = class extends CognitoError {
+  constructor(message, cognitoException) {
+    super(message, "VerifySoftwareTokenError", cognitoException);
+    this.cognitoException = cognitoException;
+  }
+};
+var AssociateSoftwareTokenError = class extends CognitoError {
+  constructor(message, cognitoException) {
+    super(message, "AssociateSoftwareTokenError", cognitoException);
+    this.cognitoException = cognitoException;
+  }
+};
 
 // src/bigint-math.ts
 var abs = (n) => n < 0n ? -n : n;
 function eGcd(a, b) {
-  if (typeof a === "number")
-    a = BigInt(a);
-  if (typeof b === "number")
-    b = BigInt(b);
-  if (a <= 0n || b <= 0n)
-    throw new RangeError("a and b MUST be > 0");
+  if (typeof a === "number") a = BigInt(a);
+  if (typeof b === "number") b = BigInt(b);
+  if (a <= 0n || b <= 0n) throw new RangeError("a and b MUST be > 0");
   let x = 0n;
   let y = 1n;
   let u = 1n;
@@ -708,6 +717,11 @@ var ServiceTarget = /* @__PURE__ */ ((ServiceTarget2) => {
   ServiceTarget2["UpdateUserAttributes"] = "UpdateUserAttributes";
   ServiceTarget2["VerifyUserAttribute"] = "VerifyUserAttribute";
   ServiceTarget2["GlobalSignOut"] = "GlobalSignOut";
+  ServiceTarget2["GetUser"] = "GetUser";
+  ServiceTarget2["AssociateSoftwareToken"] = "AssociateSoftwareToken";
+  ServiceTarget2["VerifySoftwareToken"] = "VerifySoftwareToken";
+  ServiceTarget2["ListDevices"] = "ListDevices";
+  ServiceTarget2["SetUserMFAPreference"] = "SetUserMFAPreference";
   return ServiceTarget2;
 })(ServiceTarget || {});
 var IdentityProvider = /* @__PURE__ */ ((IdentityProvider2) => {
@@ -718,12 +732,10 @@ var IdentityProvider = /* @__PURE__ */ ((IdentityProvider2) => {
   IdentityProvider2["Apple"] = "SignInWithApple";
   return IdentityProvider2;
 })(IdentityProvider || {});
-function authResultToSession(authenticationResult) {
+function adaptExpiresIn(auth) {
   return {
-    accessToken: authenticationResult.AccessToken,
-    idToken: authenticationResult.IdToken,
-    expiresIn: (/* @__PURE__ */ new Date()).getTime() + authenticationResult.ExpiresIn * 1e3,
-    refreshToken: authenticationResult.RefreshToken
+    ...auth,
+    ExpiresIn: (/* @__PURE__ */ new Date()).getTime() + auth.ExpiresIn * 1e3
   };
 }
 async function cognitoRequest(body, serviceTarget, cognitoEndpoint) {
@@ -778,6 +790,8 @@ async function cognitoRequest(body, serviceTarget, cognitoEndpoint) {
       throw new VerifyUserAttributeError(errorMessage, cognitoException);
     case "GlobalSignOut" /* GlobalSignOut */:
       throw new GlobalSignOutError(errorMessage, cognitoException);
+    case "VerifySoftwareToken" /* VerifySoftwareToken */:
+      throw new VerifySoftwareTokenError(errorMessage, cognitoException);
   }
 }
 var CognitoClient = class {
@@ -789,9 +803,9 @@ var CognitoClient = class {
     this.oAuth = oAuth;
     this.clientSecret = clientSecret;
   }
-  static getDecodedTokenFromSession(session) {
-    const { payload: idToken } = decodeJwt(session.idToken);
-    const { payload: accessToken } = decodeJwt(session.accessToken);
+  static getDecodedTokenFromSession(auth) {
+    const { payload: idToken } = decodeJwt(auth.IdToken);
+    const { payload: accessToken } = decodeJwt(auth.AccessToken);
     return {
       idToken,
       accessToken
@@ -810,27 +824,29 @@ var CognitoClient = class {
   async authenticateUserSrp(username, password) {
     const smallA = await generateSmallA();
     const A = generateA(smallA);
-    const initiateAuthPayload = {
-      AuthFlow: "USER_SRP_AUTH",
-      ClientId: this.userPoolClientId,
-      AuthParameters: {
-        USERNAME: username,
-        SRP_A: A.toString(16),
-        SECRET_HASH: this.clientSecret && await calculateSecretHash(this.clientSecret, this.userPoolClientId, username)
+    const initUserSrpAuthResponse = await cognitoRequest(
+      {
+        AuthFlow: "USER_SRP_AUTH",
+        ClientId: this.userPoolClientId,
+        AuthParameters: {
+          USERNAME: username,
+          SRP_A: A.toString(16),
+          SECRET_HASH: this.clientSecret && await calculateSecretHash(this.clientSecret, this.userPoolClientId, username)
+        },
+        ClientMetadata: {}
       },
-      ClientMetadata: {}
-    };
-    const challenge = await cognitoRequest(
-      initiateAuthPayload,
       "InitiateAuth" /* InitiateAuth */,
       this.cognitoEndpoint
     );
-    const B = BigInt("0x" + challenge.ChallengeParameters.SRP_B);
-    const salt = BigInt("0x" + challenge.ChallengeParameters.SALT);
+    if (initUserSrpAuthResponse.ChallengeName !== "PASSWORD_VERIFIER") {
+      return initUserSrpAuthResponse;
+    }
+    const B = BigInt("0x" + initUserSrpAuthResponse.ChallengeParameters.SRP_B);
+    const salt = BigInt("0x" + initUserSrpAuthResponse.ChallengeParameters.SALT);
     const U = await calculateU(A, B);
     const hkdf = await getPasswordAuthenticationKey(
       this.cognitoPoolName,
-      challenge.ChallengeParameters.USER_ID_FOR_SRP,
+      initUserSrpAuthResponse.ChallengeParameters.USER_ID_FOR_SRP,
       password,
       B,
       U,
@@ -839,32 +855,31 @@ var CognitoClient = class {
     );
     const { signature, timeStamp } = await calculateSignature(
       this.cognitoPoolName,
-      challenge.ChallengeParameters.USER_ID_FOR_SRP,
-      challenge.ChallengeParameters.SECRET_BLOCK,
+      initUserSrpAuthResponse.ChallengeParameters.USER_ID_FOR_SRP,
+      initUserSrpAuthResponse.ChallengeParameters.SECRET_BLOCK,
       hkdf
     );
-    const respondToAuthChallengeRequest = {
+    const passwordAuthChallengeResponse = await this.respondToAuthChallenge({
       ChallengeName: "PASSWORD_VERIFIER",
-      ClientId: this.userPoolClientId,
       ChallengeResponses: {
-        PASSWORD_CLAIM_SECRET_BLOCK: challenge.ChallengeParameters.SECRET_BLOCK,
+        PASSWORD_CLAIM_SECRET_BLOCK: initUserSrpAuthResponse.ChallengeParameters.SECRET_BLOCK,
         PASSWORD_CLAIM_SIGNATURE: signature,
-        USERNAME: challenge.ChallengeParameters.USER_ID_FOR_SRP,
+        USERNAME: initUserSrpAuthResponse.ChallengeParameters.USER_ID_FOR_SRP,
         TIMESTAMP: timeStamp,
         SECRET_HASH: this.clientSecret && await calculateSecretHash(
           this.clientSecret,
           this.userPoolClientId,
-          challenge.ChallengeParameters.USER_ID_FOR_SRP
+          initUserSrpAuthResponse.ChallengeParameters.USER_ID_FOR_SRP
         )
       },
       ClientMetadata: {}
-    };
-    const { AuthenticationResult } = await cognitoRequest(
-      respondToAuthChallengeRequest,
-      "RespondToAuthChallenge" /* RespondToAuthChallenge */,
-      this.cognitoEndpoint
-    );
-    return authResultToSession(AuthenticationResult);
+    });
+    if (passwordAuthChallengeResponse.AuthenticationResult) {
+      passwordAuthChallengeResponse.AuthenticationResult = adaptExpiresIn(
+        passwordAuthChallengeResponse.AuthenticationResult
+      );
+    }
+    return passwordAuthChallengeResponse;
   }
   /**
    *
@@ -886,13 +901,18 @@ var CognitoClient = class {
       },
       ClientMetadata: {}
     };
-    const { AuthenticationResult } = await cognitoRequest(
+    const initUserPasswordAuthResponse = await cognitoRequest(
       initiateAuthPayload,
       "InitiateAuth" /* InitiateAuth */,
       this.cognitoEndpoint
     );
-    const session = authResultToSession(AuthenticationResult);
-    return session;
+    if (!initUserPasswordAuthResponse.AuthenticationResult) {
+      return initUserPasswordAuthResponse;
+    }
+    initUserPasswordAuthResponse.AuthenticationResult = adaptExpiresIn(
+      initUserPasswordAuthResponse.AuthenticationResult
+    );
+    return initUserPasswordAuthResponse;
   }
   /**
    * Returns a new session based on the given refresh token.
@@ -917,10 +937,16 @@ var CognitoClient = class {
       "InitiateAuth" /* InitiateAuth */,
       this.cognitoEndpoint
     );
+    if (!AuthenticationResult) {
+      throw new InitAuthError(
+        "Authentication failed, no authentication result returned",
+        "InternalErrorException" /* InternalErrorException */
+      );
+    }
     if (!AuthenticationResult.RefreshToken) {
       AuthenticationResult.RefreshToken = refreshToken;
     }
-    return authResultToSession(AuthenticationResult);
+    return adaptExpiresIn(AuthenticationResult);
   }
   /**
    *
@@ -975,6 +1001,63 @@ var CognitoClient = class {
     };
     await cognitoRequest(changePasswordPayload, "ChangePassword" /* ChangePassword */, this.cognitoEndpoint);
   }
+  async getUser(accessToken) {
+    const getUserPayload = {
+      AccessToken: accessToken
+    };
+    return cognitoRequest(getUserPayload, "GetUser" /* GetUser */, this.cognitoEndpoint);
+  }
+  async associateSoftwareToken(params) {
+    return cognitoRequest(params, "AssociateSoftwareToken" /* AssociateSoftwareToken */, this.cognitoEndpoint);
+  }
+  async verifySoftwareToken(params) {
+    return cognitoRequest(params, "VerifySoftwareToken" /* VerifySoftwareToken */, this.cognitoEndpoint);
+  }
+  /**
+   * Responds to an authentication challenge.
+   * @param params Request to respond to an authentication challenge.
+   * @param params.ChallengeName Name of the challenge to respond to.
+   * @param params.ChallengeResponses Responses to the challenge.
+   * @param params.Session Session identifier for the authentication process.
+   * @param params.ClientMetadata Optional metadata to pass to the service.
+   * @param params.AccessToken Access token of the current user.
+   * @param params.SecretHash Optional secret hash for the user pool client.
+   * @returns
+   */
+  async respondToAuthChallenge(params) {
+    return cognitoRequest(
+      {
+        ...params,
+        ClientId: this.userPoolClientId
+      },
+      "RespondToAuthChallenge" /* RespondToAuthChallenge */,
+      this.cognitoEndpoint
+    );
+  }
+  /**
+   * Lists the devices associated with the user.
+   * @param request Request to list devices.
+   * @param request.AccessToken Access token of the current user.
+   * @param request.Limit Maximum number of devices to return.
+   * @param request.PaginationToken Pagination token to continue listing devices.
+   * @returns
+   */
+  async listDevices(request) {
+    return cognitoRequest(request, "ListDevices" /* ListDevices */, this.cognitoEndpoint);
+  }
+  /**
+   * 
+   * @param request Request to set user MFA preferences.
+   * @param request.AccessToken Access token of the current user.
+   * @param request.EmailMfaSettings Optional settings for email MFA.
+   * @param request.SMSMfaSettings Optional settings for SMS MFA.
+   * @param request.SoftwareTokenMfaSettings Optional settings for software token MFA.
+   
+   * @returns 
+   */
+  async setUserMFAPreference(request) {
+    return cognitoRequest(request, "SetUserMFAPreference" /* SetUserMFAPreference */, this.cognitoEndpoint);
+  }
   /**
    * Updates the user attributes.
    *
@@ -1111,15 +1194,17 @@ var CognitoClient = class {
    *
    * @throws {Error}
    */
-  async handleCodeFlow(returnUrl, pkce) {
+  async handleCodeFlow(returnUrl, pkce, state) {
     if (this.oAuth === void 0) {
       throw Error("You have to define oAuth options to use handleCodeFlow");
     }
     const url = new URL(returnUrl);
     const code = url.searchParams.get("code");
-    const state = url.searchParams.get("state");
-    if (code === null || state === null) {
-      throw Error("code or state parameter is missing from return url.");
+    if (code === null) {
+      throw Error("code parameter is missing from return url.");
+    }
+    if (url.searchParams.get("state") !== state) {
+      throw Error("State parameter does not match.");
     }
     const urlParams = new URLSearchParams();
     urlParams.append("grant_type", "authorization_code");
@@ -1139,13 +1224,12 @@ var CognitoClient = class {
     if (error) {
       throw new Error(error);
     }
-    const session = authResultToSession({
+    return adaptExpiresIn({
       AccessToken: access_token,
       RefreshToken: refresh_token,
       IdToken: id_token,
       ExpiresIn: expires_in
     });
-    return session;
   }
   /**
    * Invalidates the identity, access, and refresh tokens that Amazon Cognito issued to a user. Call this operation when your user signs out of your app. This results in the following behavior.
@@ -1159,6 +1243,7 @@ var CognitoClient = class {
   }
 };
 export {
+  AssociateSoftwareTokenError,
   AssociateSoftwareTokenException,
   COMMON_EXCEPTIONS,
   ChangePasswordError,
@@ -1200,9 +1285,10 @@ export {
   UpdateDeviceStatusException,
   UpdateUserAttributesError,
   UpdateUserAttributesException,
+  VerifySoftwareTokenError,
   VerifySoftwareTokenException,
   VerifyUserAttributeError,
   VerifyUserAttributeException,
-  authResultToSession,
+  adaptExpiresIn,
   cognitoRequest
 };

package/lib/cognito-client.d.ts

@@ -9,7 +9,7 @@ export interface CognitoBaseRequest {
         IpAddress?: string;
     };
 }
-export interface AuthIntiUserSrpRequest extends CognitoBaseRequest {
+export interface InitiateAuthUserSrpAuthRequest extends CognitoBaseRequest {
     AuthFlow: 'USER_SRP_AUTH';
     AuthParameters: {
         USERNAME: string;
@@ -17,7 +17,7 @@ export interface AuthIntiUserSrpRequest extends CognitoBaseRequest {
         SECRET_HASH?: string;
     };
 }
-export interface AuthIntiUserPasswordRequest extends CognitoBaseRequest {
+export interface InitiateAuthUserPasswordAuthRequest extends CognitoBaseRequest {
     AuthFlow: 'USER_PASSWORD_AUTH';
     AuthParameters: {
         USERNAME: string;
@@ -25,25 +25,25 @@ export interface AuthIntiUserPasswordRequest extends CognitoBaseRequest {
         SECRET_HASH?: string;
     };
 }
-export interface AuthIntiRefreshTokenRequest extends CognitoBaseRequest {
+export interface InitiateAuthRefreshTokenAuthRequest extends CognitoBaseRequest {
     AuthFlow: 'REFRESH_TOKEN_AUTH';
     AuthParameters: {
         REFRESH_TOKEN: string;
         SECRET_HASH?: string;
     };
 }
-export interface AuthIntiCustomAuthRequest extends CognitoBaseRequest {
+export interface InitiateAuthCustomAuthRequest extends CognitoBaseRequest {
     AuthFlow: 'CUSTOM_AUTH';
     AuthParameters: {
         USERNAME: string;
         SECRET_HASH?: string;
     };
 }
-export type AuthIntiRequest = AuthIntiUserSrpRequest | AuthIntiRefreshTokenRequest | AuthIntiCustomAuthRequest | AuthIntiUserPasswordRequest;
+export type InitiateAuthRequest = InitiateAuthUserSrpAuthRequest | InitiateAuthRefreshTokenAuthRequest | InitiateAuthCustomAuthRequest | InitiateAuthUserPasswordAuthRequest;
 export interface RespondToAuthChallengeBaseRequest extends CognitoBaseRequest {
     Session?: string;
 }
-export interface RespondToAuthChallengePasswordVerifierRequest extends RespondToAuthChallengeBaseRequest {
+export interface _RespondToAuthChallengePasswordVerifierRequest extends RespondToAuthChallengeBaseRequest {
     ChallengeName: 'PASSWORD_VERIFIER';
     ChallengeResponses: {
         USERNAME: string;
@@ -53,7 +53,7 @@ export interface RespondToAuthChallengePasswordVerifierRequest extends RespondTo
         SECRET_HASH?: string;
     };
 }
-export interface RespondToAuthChallengeSmsMfaRequest extends RespondToAuthChallengeBaseRequest {
+export interface _RespondToAuthChallengeSmsMfaRequest extends RespondToAuthChallengeBaseRequest {
     ChallengeName: 'SMS_MFA';
     ChallengeResponses: {
         USERNAME: string;
@@ -61,7 +61,7 @@ export interface RespondToAuthChallengeSmsMfaRequest extends RespondToAuthChalle
         SECRET_HASH?: string;
     };
 }
-export interface RespondToAuthChallengeCustomChallengeNameRequest extends RespondToAuthChallengeBaseRequest {
+export interface _RespondToAuthChallengeCustomChallengeNameRequest extends RespondToAuthChallengeBaseRequest {
     ChallengeName: 'CUSTOM_CHALLENGE';
     ChallengeResponses: {
         USERNAME: string;
@@ -69,7 +69,7 @@ export interface RespondToAuthChallengeCustomChallengeNameRequest extends Respon
         SECRET_HASH?: string;
     };
 }
-export interface RespondToAuthChallengeNewPasswordRequiredRequest extends RespondToAuthChallengeBaseRequest {
+export interface _RespondToAuthChallengeNewPasswordRequiredRequest extends RespondToAuthChallengeBaseRequest {
     ChallengeName: 'NEW_PASSWORD_REQUIRED';
     ChallengeResponses: {
         USERNAME: string;
@@ -77,7 +77,7 @@ export interface RespondToAuthChallengeNewPasswordRequiredRequest extends Respon
         SECRET_HASH?: string;
     };
 }
-export interface RespondToAuthChallengeSoftwareTokenMfaRequest extends RespondToAuthChallengeBaseRequest {
+export interface _RespondToAuthChallengeSoftwareTokenMfaRequest extends RespondToAuthChallengeBaseRequest {
     ChallengeName: 'SOFTWARE_TOKEN_MFA';
     ChallengeResponses: {
         USERNAME: string;
@@ -85,7 +85,7 @@ export interface RespondToAuthChallengeSoftwareTokenMfaRequest extends RespondTo
         SECRET_HASH?: string;
     };
 }
-export interface RespondToAuthChallengeDeviceSrpAuthRequest extends RespondToAuthChallengeBaseRequest {
+export interface _RespondToAuthChallengeDeviceSrpAuthRequest extends RespondToAuthChallengeBaseRequest {
     ChallengeName: 'DEVICE_SRP_AUTH';
     ChallengeResponses: {
         USERNAME: string;
@@ -93,7 +93,7 @@ export interface RespondToAuthChallengeDeviceSrpAuthRequest extends RespondToAut
         SECRET_HASH?: string;
     };
 }
-export interface RespondToAuthChallengeDevicePasswordVerifierRequest extends RespondToAuthChallengeBaseRequest {
+export interface _RespondToAuthChallengeDevicePasswordVerifierRequest extends RespondToAuthChallengeBaseRequest {
     ChallengeName: 'DEVICE_PASSWORD_VERIFIER';
     ChallengeResponses: {
         USERNAME: string;
@@ -104,7 +104,7 @@ export interface RespondToAuthChallengeDevicePasswordVerifierRequest extends Res
         SECRET_HASH?: string;
     };
 }
-export interface RespondToAuthChallengeMfaSetupRequest extends RespondToAuthChallengeBaseRequest {
+export interface _RespondToAuthChallengeMfaSetupRequest extends RespondToAuthChallengeBaseRequest {
     ChallengeName: 'MFA_SETUP';
     ChallengeResponses: {
         USERNAME: string;
@@ -113,7 +113,7 @@ export interface RespondToAuthChallengeMfaSetupRequest extends RespondToAuthChal
         SECRET_HASH?: string;
     };
 }
-export interface RespondToAuthChallengeSelectMfaTypeRequest extends RespondToAuthChallengeBaseRequest {
+export interface _RespondToAuthChallengeSelectMfaTypeRequest extends RespondToAuthChallengeBaseRequest {
     ChallengeName: 'SELECT_MFA_TYPE';
     ChallengeResponses: {
         USERNAME: string;
@@ -121,7 +121,8 @@ export interface RespondToAuthChallengeSelectMfaTypeRequest extends RespondToAut
         SECRET_HASH?: string;
     };
 }
-export type RespondToAuthChallengeRequest = RespondToAuthChallengePasswordVerifierRequest | RespondToAuthChallengeSmsMfaRequest | RespondToAuthChallengeCustomChallengeNameRequest | RespondToAuthChallengeNewPasswordRequiredRequest | RespondToAuthChallengeSoftwareTokenMfaRequest | RespondToAuthChallengeDeviceSrpAuthRequest | RespondToAuthChallengeDevicePasswordVerifierRequest | RespondToAuthChallengeMfaSetupRequest | RespondToAuthChallengeSelectMfaTypeRequest;
+type _RespondToAuthChallengeRequest = _RespondToAuthChallengePasswordVerifierRequest | _RespondToAuthChallengeSmsMfaRequest | _RespondToAuthChallengeCustomChallengeNameRequest | _RespondToAuthChallengeNewPasswordRequiredRequest | _RespondToAuthChallengeSoftwareTokenMfaRequest | _RespondToAuthChallengeDeviceSrpAuthRequest | _RespondToAuthChallengeDevicePasswordVerifierRequest | _RespondToAuthChallengeMfaSetupRequest | _RespondToAuthChallengeSelectMfaTypeRequest;
+export type RespondToAuthChallengeRequest = Omit<_RespondToAuthChallengePasswordVerifierRequest, 'ClientId'> | Omit<_RespondToAuthChallengeSmsMfaRequest, 'ClientId'> | Omit<_RespondToAuthChallengeCustomChallengeNameRequest, 'ClientId'> | Omit<_RespondToAuthChallengeNewPasswordRequiredRequest, 'ClientId'> | Omit<_RespondToAuthChallengeSoftwareTokenMfaRequest, 'ClientId'> | Omit<_RespondToAuthChallengeDeviceSrpAuthRequest, 'ClientId'> | Omit<_RespondToAuthChallengeDevicePasswordVerifierRequest, 'ClientId'> | Omit<_RespondToAuthChallengeMfaSetupRequest, 'ClientId'> | Omit<_RespondToAuthChallengeSelectMfaTypeRequest, 'ClientId'>;
 export interface UserAttribute {
     Name: string;
     Value: string;
@@ -199,27 +200,6 @@ export interface CognitoClientProps {
      */
     clientSecret?: string;
 }
-/**
- * Cognito User Session
- */
-export interface Session {
-    /**
-     * JWT Access Token
-     */
-    accessToken: string;
-    /**
-     * JWT ID Token
-     */
-    idToken: string;
-    /**
-     * JWT refresh token
-     */
-    refreshToken: string;
-    /**
-     * Validity of the session in time stamp as milliseconds.
-     */
-    expiresIn: number;
-}
 /**
  * Represents the decoded values from a JWT ID token.
  */
@@ -273,7 +253,51 @@ export declare enum ServiceTarget {
     ResendConfirmationCode = "ResendConfirmationCode",
     UpdateUserAttributes = "UpdateUserAttributes",
     VerifyUserAttribute = "VerifyUserAttribute",
-    GlobalSignOut = "GlobalSignOut"
+    GlobalSignOut = "GlobalSignOut",
+    GetUser = "GetUser",
+    AssociateSoftwareToken = "AssociateSoftwareToken",
+    VerifySoftwareToken = "VerifySoftwareToken",
+    ListDevices = "ListDevices",
+    SetUserMFAPreference = "SetUserMFAPreference"
+}
+export interface AssociateSoftwareTokenRequest {
+    AccessToken?: string;
+    Session?: string;
+}
+export interface AssociateSoftwareResponse {
+    SecretCode: string;
+    Session: string;
+}
+export interface VerifySoftwareTokenRequest {
+    AccessToken?: string;
+    FriendlyDeviceName?: string;
+    Session?: string;
+    UserCode: string;
+}
+export interface VerifySoftwareTokenResponse {
+    Session: string;
+    Status: 'SUCCESS' | 'ERROR';
+}
+export interface ListDevicesRequest {
+    AccessToken: string;
+    Limit: number;
+    PaginationToken?: 'string';
+}
+export interface Device {
+    DeviceAttributes: [
+        {
+            Name: string;
+            Value: string;
+        }
+    ];
+    DeviceCreateDate: number;
+    DeviceKey: string;
+    DeviceLastAuthenticatedDate: number;
+    DeviceLastModifiedDate: number;
+}
+export interface ListDevicesResponse {
+    Devices: Device[];
+    PaginationToken?: string;
 }
 /**
  * Cognito supported federated identities public providers.
@@ -291,11 +315,19 @@ export interface AuthenticationResult {
     ExpiresIn: number;
     IdToken: string;
     RefreshToken: string;
+    NewDeviceMetadata?: NewDeviceMetadata;
+}
+export interface NewDeviceMetadata {
+    DeviceKey?: string;
+    DeviceGroupKey?: string;
 }
-export interface AuthenticationResponse {
+export interface InitiateAuthAuthenticationResponse {
     AuthenticationResult: AuthenticationResult;
+    ChallengeName?: never;
+    session?: never;
 }
-export interface ChallengeResponse {
+export interface InitiateAuthPasswordVerifierChallengeResponse {
+    AuthenticationResult?: never;
     ChallengeName: 'PASSWORD_VERIFIER';
     ChallengeParameters: {
         SALT: string;
@@ -304,9 +336,117 @@ export interface ChallengeResponse {
         USERNAME: string;
         USER_ID_FOR_SRP: string;
     };
+    session?: never;
+}
+export interface InitiateAuthSoftwareTokenMfaChallengeResponse {
+    AuthenticationResult?: never;
+    ChallengeName: 'SOFTWARE_TOKEN_MFA';
+    Session: string;
+}
+export interface InitiateEmailOtpChallengeResponse {
+    ChallengeName: 'EMAIL_OTP';
+    ChallengeParameters: {
+        CODE_DELIVERY_DELIVERY_MEDIUM: string;
+        CODE_DELIVERY_DESTINATION: string;
+    };
+    session: string;
+}
+export interface MfaOption {
+    DeliveryMedium: 'SMS' | 'EMAIL';
+    AttributeName: string;
+}
+export interface GetUserResponse {
+    UserAttributes: UserAttribute[];
+    Username: string;
+    UserMFASettingList?: string[];
+    MFAOptions?: MfaOption[];
+    PreferredMfaSetting: string;
+}
+export interface SetUserMFAPreferenceRequest {
+    AccessToken: string;
+    EmailMfaSettings?: {
+        Enabled?: boolean;
+        PreferredMfa?: boolean;
+    };
+    SMSMfaSettings?: {
+        Enabled?: boolean;
+        PreferredMfa?: boolean;
+    };
+    SoftwareTokenMfaSettings?: {
+        Enabled?: boolean;
+        PreferredMfa?: boolean;
+    };
 }
-export declare function authResultToSession(authenticationResult: AuthenticationResult): Session;
-export declare function cognitoRequest(body: object, serviceTarget: ServiceTarget, cognitoEndpoint: string): Promise<any>;
+export type InitiateAuthChallengeResponse = InitiateAuthPasswordVerifierChallengeResponse | InitiateAuthSoftwareTokenMfaChallengeResponse;
+export type InitiateAuthResponse = InitiateAuthAuthenticationResponse | InitiateAuthPasswordVerifierChallengeResponse | InitiateAuthChallengeResponse;
+type CognitoResponseMap = {
+    [ServiceTarget.InitiateAuth]: InitiateAuthResponse;
+    [ServiceTarget.RespondToAuthChallenge]: InitiateAuthResponse;
+    [ServiceTarget.SignUp]: {
+        UserConfirmed: boolean;
+        UserSub: string;
+    };
+    [ServiceTarget.ConfirmSignUp]: void;
+    [ServiceTarget.ChangePassword]: void;
+    [ServiceTarget.RevokeToken]: void;
+    [ServiceTarget.ForgotPassword]: void;
+    [ServiceTarget.ConfirmForgotPassword]: void;
+    [ServiceTarget.ResendConfirmationCode]: void;
+    [ServiceTarget.UpdateUserAttributes]: void;
+    [ServiceTarget.VerifyUserAttribute]: void;
+    [ServiceTarget.GlobalSignOut]: void;
+    [ServiceTarget.GetUser]: GetUserResponse;
+    [ServiceTarget.AssociateSoftwareToken]: AssociateSoftwareResponse;
+    [ServiceTarget.VerifySoftwareToken]: VerifySoftwareTokenResponse;
+    [ServiceTarget.ListDevices]: ListDevicesResponse;
+    [ServiceTarget.SetUserMFAPreference]: void;
+};
+type CognitoRequestMap = {
+    [ServiceTarget.InitiateAuth]: InitiateAuthRequest;
+    [ServiceTarget.RespondToAuthChallenge]: _RespondToAuthChallengeRequest;
+    [ServiceTarget.SignUp]: SignUpRequest;
+    [ServiceTarget.ConfirmSignUp]: ConfirmSignUpRequest;
+    [ServiceTarget.ChangePassword]: {
+        PreviousPassword: string;
+        ProposedPassword: string;
+        AccessToken: string;
+    };
+    [ServiceTarget.RevokeToken]: {
+        Token: string;
+        ClientId: string;
+        ClientSecret?: string;
+    };
+    [ServiceTarget.ForgotPassword]: ForgotPasswordRequest;
+    [ServiceTarget.ConfirmForgotPassword]: ConfirmForgotPasswordRequest;
+    [ServiceTarget.ResendConfirmationCode]: ResendConfirmationCodeRequest;
+    [ServiceTarget.UpdateUserAttributes]: {
+        UserAttributes: UserAttribute[];
+        AccessToken: string;
+    };
+    [ServiceTarget.VerifyUserAttribute]: {
+        AttributeName: string;
+        Code: string;
+        AccessToken: string;
+    };
+    [ServiceTarget.GlobalSignOut]: {
+        AccessToken: string;
+    };
+    [ServiceTarget.GetUser]: {
+        AccessToken: string;
+    };
+    [ServiceTarget.AssociateSoftwareToken]: AssociateSoftwareTokenRequest;
+    [ServiceTarget.VerifySoftwareToken]: VerifySoftwareTokenRequest;
+    [ServiceTarget.ListDevices]: ListDevicesRequest;
+    [ServiceTarget.SetUserMFAPreference]: SetUserMFAPreferenceRequest;
+};
+export declare function adaptExpiresIn(auth: AuthenticationResult): {
+    ExpiresIn: number;
+    AccessToken: string;
+    IdToken: string;
+    RefreshToken: string;
+    NewDeviceMetadata?: NewDeviceMetadata | undefined;
+};
+export declare function cognitoRequest<T extends ServiceTarget>(body: CognitoRequestMap[T], serviceTarget: T, cognitoEndpoint: string): Promise<CognitoResponseMap[T]>;
 /**
  * Lightweight AWS Cogito client without any AWS SDK dependencies.
  */
@@ -317,7 +457,7 @@ export declare class CognitoClient {
     private readonly oAuth?;
     private readonly clientSecret?;
     constructor({ userPoolId, userPoolClientId, endpoint, oAuth2: oAuth, clientSecret }: CognitoClientProps);
-    static getDecodedTokenFromSession(session: Session): DecodedTokens;
+    static getDecodedTokenFromSession(auth: AuthenticationResult): DecodedTokens;
     /**
      *
      * Performs user authentication with username and password through ALLOW_USER_SRP_AUTH .
@@ -328,7 +468,7 @@ export declare class CognitoClient {
      *
      * @throws {InitAuthError, CognitoRespondToAuthChallengeError}
      */
-    authenticateUserSrp(username: string, password: string): Promise<Session>;
+    authenticateUserSrp(username: string, password: string): Promise<InitiateAuthResponse>;
     /**
      *
      * Performs user authentication with username and password through USER_PASSWORD_AUTH .
@@ -338,7 +478,7 @@ export declare class CognitoClient {
      * @param password Password
      * @throws {InitAuthError}
      */
-    authenticateUser(username: string, password: string): Promise<Session>;
+    authenticateUser(username: string, password: string): Promise<InitiateAuthResponse>;
     /**
      * Returns a new session based on the given refresh token.
      *
@@ -347,7 +487,7 @@ export declare class CognitoClient {
      * @returns @see Session
      * @throws {InitAuthError}
      */
-    refreshSession(refreshToken: string, username?: string): Promise<Session>;
+    refreshSession(refreshToken: string, username?: string): Promise<AuthenticationResult>;
     /**
      *
      * @param username Username
@@ -376,6 +516,41 @@ export declare class CognitoClient {
      * @throws {ChangePasswordError}
      */
     changePassword(currentPassword: string, newPassword: string, accessToken: string): Promise<void>;
+    getUser(accessToken: string): Promise<GetUserResponse>;
+    associateSoftwareToken(params: AssociateSoftwareTokenRequest): Promise<AssociateSoftwareResponse>;
+    verifySoftwareToken(params: VerifySoftwareTokenRequest): Promise<VerifySoftwareTokenResponse>;
+    /**
+     * Responds to an authentication challenge.
+     * @param params Request to respond to an authentication challenge.
+     * @param params.ChallengeName Name of the challenge to respond to.
+     * @param params.ChallengeResponses Responses to the challenge.
+     * @param params.Session Session identifier for the authentication process.
+     * @param params.ClientMetadata Optional metadata to pass to the service.
+     * @param params.AccessToken Access token of the current user.
+     * @param params.SecretHash Optional secret hash for the user pool client.
+     * @returns
+     */
+    respondToAuthChallenge(params: RespondToAuthChallengeRequest): Promise<InitiateAuthResponse>;
+    /**
+     * Lists the devices associated with the user.
+     * @param request Request to list devices.
+     * @param request.AccessToken Access token of the current user.
+     * @param request.Limit Maximum number of devices to return.
+     * @param request.PaginationToken Pagination token to continue listing devices.
+     * @returns
+     */
+    listDevices(request: ListDevicesRequest): Promise<ListDevicesResponse>;
+    /**
+     *
+     * @param request Request to set user MFA preferences.
+     * @param request.AccessToken Access token of the current user.
+     * @param request.EmailMfaSettings Optional settings for email MFA.
+     * @param request.SMSMfaSettings Optional settings for SMS MFA.
+     * @param request.SoftwareTokenMfaSettings Optional settings for software token MFA.
+     
+     * @returns
+     */
+    setUserMFAPreference(request: SetUserMFAPreferenceRequest): Promise<void>;
     /**
      * Updates the user attributes.
      *
@@ -452,10 +627,11 @@ export declare class CognitoClient {
      *
      * @throws {Error}
      */
-    handleCodeFlow(returnUrl: string, pkce: string): Promise<Session>;
+    handleCodeFlow(returnUrl: string, pkce: string, state: string): Promise<AuthenticationResult>;
     /**
      * Invalidates the identity, access, and refresh tokens that Amazon Cognito issued to a user. Call this operation when your user signs out of your app. This results in the following behavior.
      * @param accessToken Access token of the current user.
      */
     globalSignOut(accessToken: string): Promise<void>;
 }
+export {};

package/lib/cognito-client.js

@@ -1,4 +1,4 @@
-import { ChangePasswordError, ConfirmForgotPasswordError, ConfirmSignUpError, ForgotPasswordError, GlobalSignOutError, InitAuthError, ResendConfirmationCodeError, RespondToAuthChallengeError, RevokeTokenError, SignUpError, UpdateUserAttributesError, VerifyUserAttributeError, COMMON_EXCEPTIONS, CommonError } from './error.js';
+import { ChangePasswordError, ConfirmForgotPasswordError, ConfirmSignUpError, ForgotPasswordError, GlobalSignOutError, InitAuthError, ResendConfirmationCodeError, RespondToAuthChallengeError, RevokeTokenError, SignUpError, UpdateUserAttributesError, VerifyUserAttributeError, InitiateAuthException, COMMON_EXCEPTIONS, CommonError, VerifySoftwareTokenError } from './error.js';
 import { calculateSecretHash, calculateSignature, calculateU, decodeJwt, digest, generateA, generateSmallA, getPasswordAuthenticationKey, randomBytes, uint8ArrayFromString, uint8ArrayToBase64String } from './utils.js';
 /**
  * List of used and supported Cognito API calls.
@@ -18,6 +18,11 @@ export var ServiceTarget;
     ServiceTarget["UpdateUserAttributes"] = "UpdateUserAttributes";
     ServiceTarget["VerifyUserAttribute"] = "VerifyUserAttribute";
     ServiceTarget["GlobalSignOut"] = "GlobalSignOut";
+    ServiceTarget["GetUser"] = "GetUser";
+    ServiceTarget["AssociateSoftwareToken"] = "AssociateSoftwareToken";
+    ServiceTarget["VerifySoftwareToken"] = "VerifySoftwareToken";
+    ServiceTarget["ListDevices"] = "ListDevices";
+    ServiceTarget["SetUserMFAPreference"] = "SetUserMFAPreference";
 })(ServiceTarget || (ServiceTarget = {}));
 /**
  * Cognito supported federated identities public providers.
@@ -31,12 +36,11 @@ export var IdentityProvider;
     IdentityProvider["Amazon"] = "LoginWithAmazon";
     IdentityProvider["Apple"] = "SignInWithApple";
 })(IdentityProvider || (IdentityProvider = {}));
-export function authResultToSession(authenticationResult) {
+export function adaptExpiresIn(auth) {
+    // Cognito returns expiresIn in seconds, but we want it in milliseconds from now
     return {
-        accessToken: authenticationResult.AccessToken,
-        idToken: authenticationResult.IdToken,
-        expiresIn: new Date().getTime() + authenticationResult.ExpiresIn * 1000,
-        refreshToken: authenticationResult.RefreshToken
+        ...auth,
+        ExpiresIn: new Date().getTime() + auth.ExpiresIn * 1000
     };
 }
 export async function cognitoRequest(body, serviceTarget, cognitoEndpoint) {
@@ -99,6 +103,8 @@ export async function cognitoRequest(body, serviceTarget, cognitoEndpoint) {
             throw new VerifyUserAttributeError(errorMessage, cognitoException);
         case ServiceTarget.GlobalSignOut:
             throw new GlobalSignOutError(errorMessage, cognitoException);
+        case ServiceTarget.VerifySoftwareToken:
+            throw new VerifySoftwareTokenError(errorMessage, cognitoException);
     }
 }
 /**
@@ -113,9 +119,9 @@ export class CognitoClient {
         this.oAuth = oAuth;
         this.clientSecret = clientSecret;
     }
-    static getDecodedTokenFromSession(session) {
-        const { payload: idToken } = decodeJwt(session.idToken);
-        const { payload: accessToken } = decodeJwt(session.accessToken);
+    static getDecodedTokenFromSession(auth) {
+        const { payload: idToken } = decodeJwt(auth.IdToken);
+        const { payload: accessToken } = decodeJwt(auth.AccessToken);
         return {
             idToken,
             accessToken
@@ -134,7 +140,7 @@ export class CognitoClient {
     async authenticateUserSrp(username, password) {
         const smallA = await generateSmallA();
         const A = generateA(smallA);
-        const initiateAuthPayload = {
+        const initUserSrpAuthResponse = await cognitoRequest({
             AuthFlow: 'USER_SRP_AUTH',
             ClientId: this.userPoolClientId,
             AuthParameters: {
@@ -143,28 +149,31 @@ export class CognitoClient {
                 SECRET_HASH: this.clientSecret && (await calculateSecretHash(this.clientSecret, this.userPoolClientId, username))
             },
             ClientMetadata: {}
-        };
-        const challenge = (await cognitoRequest(initiateAuthPayload, ServiceTarget.InitiateAuth, this.cognitoEndpoint));
-        const B = BigInt('0x' + challenge.ChallengeParameters.SRP_B);
-        const salt = BigInt('0x' + challenge.ChallengeParameters.SALT);
+        }, ServiceTarget.InitiateAuth, this.cognitoEndpoint);
+        if (initUserSrpAuthResponse.ChallengeName !== 'PASSWORD_VERIFIER') {
+            return initUserSrpAuthResponse;
+        }
+        const B = BigInt('0x' + initUserSrpAuthResponse.ChallengeParameters.SRP_B);
+        const salt = BigInt('0x' + initUserSrpAuthResponse.ChallengeParameters.SALT);
         const U = await calculateU(A, B);
-        const hkdf = await getPasswordAuthenticationKey(this.cognitoPoolName, challenge.ChallengeParameters.USER_ID_FOR_SRP, password, B, U, smallA, salt);
-        const { signature, timeStamp } = await calculateSignature(this.cognitoPoolName, challenge.ChallengeParameters.USER_ID_FOR_SRP, challenge.ChallengeParameters.SECRET_BLOCK, hkdf);
-        const respondToAuthChallengeRequest = {
+        const hkdf = await getPasswordAuthenticationKey(this.cognitoPoolName, initUserSrpAuthResponse.ChallengeParameters.USER_ID_FOR_SRP, password, B, U, smallA, salt);
+        const { signature, timeStamp } = await calculateSignature(this.cognitoPoolName, initUserSrpAuthResponse.ChallengeParameters.USER_ID_FOR_SRP, initUserSrpAuthResponse.ChallengeParameters.SECRET_BLOCK, hkdf);
+        const passwordAuthChallengeResponse = await this.respondToAuthChallenge({
             ChallengeName: 'PASSWORD_VERIFIER',
-            ClientId: this.userPoolClientId,
             ChallengeResponses: {
-                PASSWORD_CLAIM_SECRET_BLOCK: challenge.ChallengeParameters.SECRET_BLOCK,
+                PASSWORD_CLAIM_SECRET_BLOCK: initUserSrpAuthResponse.ChallengeParameters.SECRET_BLOCK,
                 PASSWORD_CLAIM_SIGNATURE: signature,
-                USERNAME: challenge.ChallengeParameters.USER_ID_FOR_SRP,
+                USERNAME: initUserSrpAuthResponse.ChallengeParameters.USER_ID_FOR_SRP,
                 TIMESTAMP: timeStamp,
                 SECRET_HASH: this.clientSecret &&
-                    (await calculateSecretHash(this.clientSecret, this.userPoolClientId, challenge.ChallengeParameters.USER_ID_FOR_SRP))
+                    (await calculateSecretHash(this.clientSecret, this.userPoolClientId, initUserSrpAuthResponse.ChallengeParameters.USER_ID_FOR_SRP))
             },
             ClientMetadata: {}
-        };
-        const { AuthenticationResult } = await cognitoRequest(respondToAuthChallengeRequest, ServiceTarget.RespondToAuthChallenge, this.cognitoEndpoint);
-        return authResultToSession(AuthenticationResult);
+        });
+        if (passwordAuthChallengeResponse.AuthenticationResult) {
+            passwordAuthChallengeResponse.AuthenticationResult = adaptExpiresIn(passwordAuthChallengeResponse.AuthenticationResult);
+        }
+        return passwordAuthChallengeResponse;
     }
     /**
      *
@@ -186,9 +195,12 @@ export class CognitoClient {
             },
             ClientMetadata: {}
         };
-        const { AuthenticationResult } = (await cognitoRequest(initiateAuthPayload, ServiceTarget.InitiateAuth, this.cognitoEndpoint));
-        const session = authResultToSession(AuthenticationResult);
-        return session;
+        const initUserPasswordAuthResponse = await cognitoRequest(initiateAuthPayload, ServiceTarget.InitiateAuth, this.cognitoEndpoint);
+        if (!initUserPasswordAuthResponse.AuthenticationResult) {
+            return initUserPasswordAuthResponse;
+        }
+        initUserPasswordAuthResponse.AuthenticationResult = adaptExpiresIn(initUserPasswordAuthResponse.AuthenticationResult);
+        return initUserPasswordAuthResponse;
     }
     /**
      * Returns a new session based on the given refresh token.
@@ -210,11 +222,14 @@ export class CognitoClient {
             },
             ClientMetadata: {}
         };
-        const { AuthenticationResult } = (await cognitoRequest(refreshTokenPayload, ServiceTarget.InitiateAuth, this.cognitoEndpoint));
+        const { AuthenticationResult } = await cognitoRequest(refreshTokenPayload, ServiceTarget.InitiateAuth, this.cognitoEndpoint);
+        if (!AuthenticationResult) {
+            throw new InitAuthError('Authentication failed, no authentication result returned', InitiateAuthException.InternalErrorException);
+        }
         if (!AuthenticationResult.RefreshToken) {
             AuthenticationResult.RefreshToken = refreshToken;
         }
-        return authResultToSession(AuthenticationResult);
+        return adaptExpiresIn(AuthenticationResult);
     }
     /**
      *
@@ -269,6 +284,59 @@ export class CognitoClient {
         };
         await cognitoRequest(changePasswordPayload, ServiceTarget.ChangePassword, this.cognitoEndpoint);
     }
+    async getUser(accessToken) {
+        const getUserPayload = {
+            AccessToken: accessToken
+        };
+        return cognitoRequest(getUserPayload, ServiceTarget.GetUser, this.cognitoEndpoint);
+    }
+    async associateSoftwareToken(params) {
+        return cognitoRequest(params, ServiceTarget.AssociateSoftwareToken, this.cognitoEndpoint);
+    }
+    async verifySoftwareToken(params) {
+        return cognitoRequest(params, ServiceTarget.VerifySoftwareToken, this.cognitoEndpoint);
+    }
+    /**
+     * Responds to an authentication challenge.
+     * @param params Request to respond to an authentication challenge.
+     * @param params.ChallengeName Name of the challenge to respond to.
+     * @param params.ChallengeResponses Responses to the challenge.
+     * @param params.Session Session identifier for the authentication process.
+     * @param params.ClientMetadata Optional metadata to pass to the service.
+     * @param params.AccessToken Access token of the current user.
+     * @param params.SecretHash Optional secret hash for the user pool client.
+     * @returns
+     */
+    async respondToAuthChallenge(params) {
+        return cognitoRequest({
+            ...params,
+            ClientId: this.userPoolClientId
+        }, ServiceTarget.RespondToAuthChallenge, this.cognitoEndpoint);
+    }
+    /**
+     * Lists the devices associated with the user.
+     * @param request Request to list devices.
+     * @param request.AccessToken Access token of the current user.
+     * @param request.Limit Maximum number of devices to return.
+     * @param request.PaginationToken Pagination token to continue listing devices.
+     * @returns
+     */
+    async listDevices(request) {
+        return cognitoRequest(request, ServiceTarget.ListDevices, this.cognitoEndpoint);
+    }
+    /**
+     *
+     * @param request Request to set user MFA preferences.
+     * @param request.AccessToken Access token of the current user.
+     * @param request.EmailMfaSettings Optional settings for email MFA.
+     * @param request.SMSMfaSettings Optional settings for SMS MFA.
+     * @param request.SoftwareTokenMfaSettings Optional settings for software token MFA.
+     
+     * @returns
+     */
+    async setUserMFAPreference(request) {
+        return cognitoRequest(request, ServiceTarget.SetUserMFAPreference, this.cognitoEndpoint);
+    }
     /**
      * Updates the user attributes.
      *
@@ -408,15 +476,17 @@ export class CognitoClient {
      *
      * @throws {Error}
      */
-    async handleCodeFlow(returnUrl, pkce) {
+    async handleCodeFlow(returnUrl, pkce, state) {
         if (this.oAuth === undefined) {
             throw Error('You have to define oAuth options to use handleCodeFlow');
         }
         const url = new URL(returnUrl);
         const code = url.searchParams.get('code');
-        const state = url.searchParams.get('state');
-        if (code === null || state === null) {
-            throw Error('code or state parameter is missing from return url.');
+        if (code === null) {
+            throw Error('code parameter is missing from return url.');
+        }
+        if (url.searchParams.get('state') !== state) {
+            throw Error('State parameter does not match.');
         }
         const urlParams = new URLSearchParams();
         urlParams.append('grant_type', 'authorization_code');
@@ -436,13 +506,12 @@ export class CognitoClient {
         if (error) {
             throw new Error(error);
         }
-        const session = authResultToSession({
+        return adaptExpiresIn({
             AccessToken: access_token,
             RefreshToken: refresh_token,
             IdToken: id_token,
             ExpiresIn: expires_in
         });
-        return session;
     }
     /**
      * Invalidates the identity, access, and refresh tokens that Amazon Cognito issued to a user. Call this operation when your user signs out of your app. This results in the following behavior.

package/lib/error.d.ts

@@ -362,11 +362,11 @@ export declare enum RevokeTokenException {
     UnsupportedOperationException = "UnsupportedOperationException",
     UnsupportedTokenTypeException = "UnsupportedTokenTypeException"
 }
-export type CognitoErrorType = 'CommonError' | 'InitAuthError' | 'RespondToAuthChallengeError' | 'SignUpError' | 'ConfirmSignUpError' | 'ChangePasswordError' | 'RevokeTokenError' | 'ForgotPasswordError' | 'ConfirmForgotPasswordError' | 'ResendConfirmationCodeError' | 'UpdateUserAttributesError' | 'VerifyUserAttributeError' | 'GlobalSignOutError';
+export type CognitoErrorType = 'CommonError' | 'InitAuthError' | 'RespondToAuthChallengeError' | 'SignUpError' | 'ConfirmSignUpError' | 'VerifySoftwareTokenError' | 'ChangePasswordError' | 'RevokeTokenError' | 'ForgotPasswordError' | 'ConfirmForgotPasswordError' | 'ResendConfirmationCodeError' | 'UpdateUserAttributesError' | 'VerifyUserAttributeError' | 'AssociateSoftwareTokenError' | 'GlobalSignOutError';
 export declare class CognitoError extends Error {
     readonly errorType: CognitoErrorType;
-    readonly cognitoException: CommonException | InitiateAuthException | RespondToAuthChallengeException | SignUpException | ConfirmSignUpException | ChangePasswordException | RevokeTokenException | ForgotPasswordException | ConfirmForgotPasswordException | ResendConfirmationException | UpdateUserAttributesException | VerifyUserAttributeException | GlobalSignOutException;
-    constructor(message: string, errorType: CognitoErrorType, cognitoException: CommonException | InitiateAuthException | RespondToAuthChallengeException | SignUpException | ConfirmSignUpException | ChangePasswordException | RevokeTokenException | ForgotPasswordException | ConfirmForgotPasswordException | ResendConfirmationException | UpdateUserAttributesException | VerifyUserAttributeException | GlobalSignOutException);
+    readonly cognitoException: CommonException | InitiateAuthException | RespondToAuthChallengeException | SignUpException | ConfirmSignUpException | ChangePasswordException | RevokeTokenException | ForgotPasswordException | ConfirmForgotPasswordException | ResendConfirmationException | UpdateUserAttributesException | VerifyUserAttributeException | GlobalSignOutException | VerifySoftwareTokenException | AssociateSoftwareTokenException;
+    constructor(message: string, errorType: CognitoErrorType, cognitoException: CommonException | InitiateAuthException | RespondToAuthChallengeException | SignUpException | ConfirmSignUpException | ChangePasswordException | RevokeTokenException | ForgotPasswordException | ConfirmForgotPasswordException | ResendConfirmationException | UpdateUserAttributesException | VerifyUserAttributeException | GlobalSignOutException | VerifySoftwareTokenException | AssociateSoftwareTokenException);
 }
 export declare class CommonError extends CognitoError {
     readonly cognitoException: CommonException;
@@ -420,3 +420,11 @@ export declare class GlobalSignOutError extends CognitoError {
     readonly cognitoException: GlobalSignOutException;
     constructor(message: string, cognitoException: GlobalSignOutException);
 }
+export declare class VerifySoftwareTokenError extends CognitoError {
+    readonly cognitoException: VerifySoftwareTokenException;
+    constructor(message: string, cognitoException: VerifySoftwareTokenException);
+}
+export declare class AssociateSoftwareTokenError extends CognitoError {
+    readonly cognitoException: AssociateSoftwareTokenException;
+    constructor(message: string, cognitoException: AssociateSoftwareTokenException);
+}

package/lib/error.js

@@ -485,3 +485,15 @@ export class GlobalSignOutError extends CognitoError {
         this.cognitoException = cognitoException;
     }
 }
+export class VerifySoftwareTokenError extends CognitoError {
+    constructor(message, cognitoException) {
+        super(message, 'VerifySoftwareTokenError', cognitoException);
+        this.cognitoException = cognitoException;
+    }
+}
+export class AssociateSoftwareTokenError extends CognitoError {
+    constructor(message, cognitoException) {
+        super(message, 'AssociateSoftwareTokenError', cognitoException);
+        this.cognitoException = cognitoException;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vardario/cognito-client",
-  "version": "4.0.6",
+  "version": "5.0.0",
   "description": "",
   "license": "MIT",
   "author": "Sahin Vardar",
@@ -16,7 +16,7 @@
   ],
   "scripts": {
     "build": "pnpm build:lib && pnpm build:browser",
-    "build:browser": "esbuild src/index.ts --bundle --outfile=lib/browser.js --platform=neutral --external:zod",
+    "build:browser": "esbuild src/index.ts --bundle --outfile=lib/browser.js --platform=neutral",
     "build:lib": "tsc --build",
     "format": "prettier --plugin-search-dir . --write . && prettier-package-json --write && eslint --fix .",
     "integration-test": "vitest run integration",
@@ -27,12 +27,13 @@
   "devDependencies": {
     "@aws-sdk/client-cognito-identity-provider": "^3.465.0",
     "@types/jsdom": "^21.1.5",
+    "@types/node": "^20",
     "@typescript-eslint/eslint-plugin": "^6.11.0",
     "@typescript-eslint/parser": "^6.11.0",
-    "esbuild": "^0.20.2",
+    "esbuild": "^0.25.8",
     "eslint": "^8.54.0",
-    "eslint-config-prettier": "^9.0.0",
-    "eslint-plugin-unused-imports": "^3.0.0",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-unused-imports": "^4.1.4",
     "husky": "^8.0.3",
     "isomorphic-fetch": "^3.0.0",
     "jsdom": "^22.1.0",