@vardario/cognito-client 5.0.0 → 5.2.0

package/lib/cognito-client.d.ts

@@ -9,7 +9,7 @@ export interface CognitoBaseRequest {
         IpAddress?: string;
     };
 }
-export interface InitiateAuthUserSrpAuthRequest extends CognitoBaseRequest {
+export interface _InitiateAuthUserSrpAuthRequest extends CognitoBaseRequest {
     AuthFlow: 'USER_SRP_AUTH';
     AuthParameters: {
         USERNAME: string;
@@ -17,7 +17,7 @@ export interface InitiateAuthUserSrpAuthRequest extends CognitoBaseRequest {
         SECRET_HASH?: string;
     };
 }
-export interface InitiateAuthUserPasswordAuthRequest extends CognitoBaseRequest {
+export interface _InitiateAuthUserPasswordAuthRequest extends CognitoBaseRequest {
     AuthFlow: 'USER_PASSWORD_AUTH';
     AuthParameters: {
         USERNAME: string;
@@ -25,21 +25,31 @@ export interface InitiateAuthUserPasswordAuthRequest extends CognitoBaseRequest
         SECRET_HASH?: string;
     };
 }
-export interface InitiateAuthRefreshTokenAuthRequest extends CognitoBaseRequest {
+export interface _InitiateAuthRefreshTokenAuthRequest extends CognitoBaseRequest {
     AuthFlow: 'REFRESH_TOKEN_AUTH';
     AuthParameters: {
         REFRESH_TOKEN: string;
         SECRET_HASH?: string;
+        USERNAME?: never;
     };
 }
-export interface InitiateAuthCustomAuthRequest extends CognitoBaseRequest {
+export interface _InitiateAuthCustomAuthRequest extends CognitoBaseRequest {
     AuthFlow: 'CUSTOM_AUTH';
     AuthParameters: {
         USERNAME: string;
         SECRET_HASH?: string;
     };
 }
-export type InitiateAuthRequest = InitiateAuthUserSrpAuthRequest | InitiateAuthRefreshTokenAuthRequest | InitiateAuthCustomAuthRequest | InitiateAuthUserPasswordAuthRequest;
+export interface _InitiateAuthUserAuthRequest extends CognitoBaseRequest {
+    AuthFlow: 'USER_AUTH';
+    AuthParameters: {
+        USERNAME: string;
+        PREFERRED_CHALLENGE?: AuthChallenge;
+        SECRET_HASH?: string;
+    };
+}
+type _InitiateAuthRequest = _InitiateAuthUserSrpAuthRequest | _InitiateAuthUserPasswordAuthRequest | _InitiateAuthRefreshTokenAuthRequest | _InitiateAuthCustomAuthRequest | _InitiateAuthUserAuthRequest;
+export type InitiateAuthRequest = Omit<_InitiateAuthUserSrpAuthRequest, 'ClientId'> | Omit<_InitiateAuthUserPasswordAuthRequest, 'ClientId'> | Omit<_InitiateAuthRefreshTokenAuthRequest, 'ClientId'> | Omit<_InitiateAuthCustomAuthRequest, 'ClientId'> | Omit<_InitiateAuthUserAuthRequest, 'ClientId'>;
 export interface RespondToAuthChallengeBaseRequest extends CognitoBaseRequest {
     Session?: string;
 }
@@ -112,6 +122,7 @@ export interface _RespondToAuthChallengeMfaSetupRequest extends RespondToAuthCha
         SOFTWARE_TOKEN_MFA_CODE?: string;
         SECRET_HASH?: string;
     };
+    Session?: never;
 }
 export interface _RespondToAuthChallengeSelectMfaTypeRequest extends RespondToAuthChallengeBaseRequest {
     ChallengeName: 'SELECT_MFA_TYPE';
@@ -121,8 +132,16 @@ export interface _RespondToAuthChallengeSelectMfaTypeRequest extends RespondToAu
         SECRET_HASH?: string;
     };
 }
-type _RespondToAuthChallengeRequest = _RespondToAuthChallengePasswordVerifierRequest | _RespondToAuthChallengeSmsMfaRequest | _RespondToAuthChallengeCustomChallengeNameRequest | _RespondToAuthChallengeNewPasswordRequiredRequest | _RespondToAuthChallengeSoftwareTokenMfaRequest | _RespondToAuthChallengeDeviceSrpAuthRequest | _RespondToAuthChallengeDevicePasswordVerifierRequest | _RespondToAuthChallengeMfaSetupRequest | _RespondToAuthChallengeSelectMfaTypeRequest;
-export type RespondToAuthChallengeRequest = Omit<_RespondToAuthChallengePasswordVerifierRequest, 'ClientId'> | Omit<_RespondToAuthChallengeSmsMfaRequest, 'ClientId'> | Omit<_RespondToAuthChallengeCustomChallengeNameRequest, 'ClientId'> | Omit<_RespondToAuthChallengeNewPasswordRequiredRequest, 'ClientId'> | Omit<_RespondToAuthChallengeSoftwareTokenMfaRequest, 'ClientId'> | Omit<_RespondToAuthChallengeDeviceSrpAuthRequest, 'ClientId'> | Omit<_RespondToAuthChallengeDevicePasswordVerifierRequest, 'ClientId'> | Omit<_RespondToAuthChallengeMfaSetupRequest, 'ClientId'> | Omit<_RespondToAuthChallengeSelectMfaTypeRequest, 'ClientId'>;
+export interface _RespondToAuthChallengeWebAuthnRequest extends RespondToAuthChallengeBaseRequest {
+    ChallengeName: 'WEB_AUTHN';
+    ChallengeResponses: {
+        USERNAME: string;
+        CREDENTIAL: any;
+        SECRET_HASH?: string;
+    };
+}
+type _RespondToAuthChallengeRequest = _RespondToAuthChallengePasswordVerifierRequest | _RespondToAuthChallengeSmsMfaRequest | _RespondToAuthChallengeCustomChallengeNameRequest | _RespondToAuthChallengeNewPasswordRequiredRequest | _RespondToAuthChallengeSoftwareTokenMfaRequest | _RespondToAuthChallengeDeviceSrpAuthRequest | _RespondToAuthChallengeDevicePasswordVerifierRequest | _RespondToAuthChallengeMfaSetupRequest | _RespondToAuthChallengeSelectMfaTypeRequest | _RespondToAuthChallengeWebAuthnRequest;
+export type RespondToAuthChallengeRequest = Omit<_RespondToAuthChallengePasswordVerifierRequest, 'ClientId'> | Omit<_RespondToAuthChallengeSmsMfaRequest, 'ClientId'> | Omit<_RespondToAuthChallengeCustomChallengeNameRequest, 'ClientId'> | Omit<_RespondToAuthChallengeNewPasswordRequiredRequest, 'ClientId'> | Omit<_RespondToAuthChallengeSoftwareTokenMfaRequest, 'ClientId'> | Omit<_RespondToAuthChallengeDeviceSrpAuthRequest, 'ClientId'> | Omit<_RespondToAuthChallengeDevicePasswordVerifierRequest, 'ClientId'> | Omit<_RespondToAuthChallengeMfaSetupRequest, 'ClientId'> | Omit<_RespondToAuthChallengeSelectMfaTypeRequest, 'ClientId'> | Omit<_RespondToAuthChallengeWebAuthnRequest, 'ClientId'>;
 export interface UserAttribute {
     Name: string;
     Value: string;
@@ -258,7 +277,11 @@ export declare enum ServiceTarget {
     AssociateSoftwareToken = "AssociateSoftwareToken",
     VerifySoftwareToken = "VerifySoftwareToken",
     ListDevices = "ListDevices",
-    SetUserMFAPreference = "SetUserMFAPreference"
+    SetUserMFAPreference = "SetUserMFAPreference",
+    StartWebAuthnRegistration = "StartWebAuthnRegistration",
+    CompleteWebAuthnRegistration = "CompleteWebAuthnRegistration",
+    DeleteWebAuthnCredential = "DeleteWebAuthnCredential",
+    ListWebAuthnCredentials = "ListWebAuthnCredentials"
 }
 export interface AssociateSoftwareTokenRequest {
     AccessToken?: string;
@@ -321,12 +344,16 @@ export interface NewDeviceMetadata {
     DeviceKey?: string;
     DeviceGroupKey?: string;
 }
-export interface InitiateAuthAuthenticationResponse {
+export type AuthChallenge = InitiateAuthChallengeResponse['ChallengeName'];
+export interface InitiateAuthBaseResponse {
+    AvailableChallenges: [];
+    Session: string;
+}
+export interface InitiateAuthAuthenticationResponse extends InitiateAuthBaseResponse {
     AuthenticationResult: AuthenticationResult;
     ChallengeName?: never;
-    session?: never;
 }
-export interface InitiateAuthPasswordVerifierChallengeResponse {
+export interface InitiateAuthPasswordVerifierChallengeResponse extends InitiateAuthBaseResponse {
     AuthenticationResult?: never;
     ChallengeName: 'PASSWORD_VERIFIER';
     ChallengeParameters: {
@@ -336,20 +363,48 @@ export interface InitiateAuthPasswordVerifierChallengeResponse {
         USERNAME: string;
         USER_ID_FOR_SRP: string;
     };
-    session?: never;
 }
-export interface InitiateAuthSoftwareTokenMfaChallengeResponse {
+export interface InitiateAuthSoftwareTokenMfaChallengeResponse extends InitiateAuthBaseResponse {
     AuthenticationResult?: never;
     ChallengeName: 'SOFTWARE_TOKEN_MFA';
+}
+export interface InitiateAuthWebAuthResponse extends InitiateAuthBaseResponse {
+    AuthenticationResult?: never;
+    ChallengeName: 'WEB_AUTHN';
     Session: string;
+    ChallengeParameters: {
+        CREDENTIAL_REQUEST_OPTIONS: string;
+    };
 }
-export interface InitiateEmailOtpChallengeResponse {
+export interface InitiateEmailOtpChallengeResponse extends InitiateAuthBaseResponse {
+    AuthenticationResult?: never;
     ChallengeName: 'EMAIL_OTP';
     ChallengeParameters: {
         CODE_DELIVERY_DELIVERY_MEDIUM: string;
         CODE_DELIVERY_DESTINATION: string;
     };
-    session: string;
+    Session: string;
+}
+export interface InitAuthSelectChallengeResponse extends InitiateAuthBaseResponse {
+    AuthenticationResult?: never;
+    ChallengeName: 'SELECT_CHALLENGE';
+    ChallengeParameters: never;
+}
+export interface InitAuthPasswordChallengeResponse extends InitiateAuthBaseResponse {
+    AuthenticationResult?: never;
+    ChallengeName: 'PASSWORD';
+    ChallengeParameters: never;
+}
+export interface InitAuthPasswordSRPChallengeResponse extends InitiateAuthBaseResponse {
+    AuthenticationResult?: never;
+    ChallengeName: 'PASSWORD_SRP';
+    ChallengeParameters: never;
+}
+export interface InitAuthMfaSetupChallengeResponse extends InitiateAuthBaseResponse {
+    AuthenticationResult?: never;
+    ChallengeName: 'MFA_SETUP';
+    ChallengeParameters: never;
+    MFAS_CAN_SETUP: ('SMS_MFA' | 'SOFTWARE_TOKEN_MFA')[];
 }
 export interface MfaOption {
     DeliveryMedium: 'SMS' | 'EMAIL';
@@ -377,7 +432,38 @@ export interface SetUserMFAPreferenceRequest {
         PreferredMfa?: boolean;
     };
 }
-export type InitiateAuthChallengeResponse = InitiateAuthPasswordVerifierChallengeResponse | InitiateAuthSoftwareTokenMfaChallengeResponse;
+export interface StartWebAuthnRegistrationRequest {
+    AccessToken: string;
+}
+export interface StartWebAuthnRegistrationResponse {
+    CredentialCreationOptions: any;
+}
+export interface CompleteWebAuthnRegistrationRequest {
+    AccessToken: string;
+    Credential: PublicKeyCredential;
+}
+export interface DeleteWebAuthnCredentialRequest {
+    AccessToken: string;
+    CredentialId: string;
+}
+export interface ListWebAuthnCredentialsRequest {
+    AccessToken: string;
+    MaxResults?: number;
+    NextToken?: string;
+}
+export interface WebAuthnCredential {
+    AuthenticatorTransports: string[];
+    CreatedAt: string;
+    CredentialId: string;
+    FriendlyCredentialName: string;
+    RelyingPartyId: string;
+    AuthenticatorAttachment?: string;
+}
+export interface ListWebAuthnCredentialsResponse {
+    Credentials: WebAuthnCredential[];
+    NextToken?: string;
+}
+export type InitiateAuthChallengeResponse = InitiateAuthPasswordVerifierChallengeResponse | InitiateAuthSoftwareTokenMfaChallengeResponse | InitiateAuthWebAuthResponse | InitiateEmailOtpChallengeResponse | InitAuthSelectChallengeResponse | InitAuthPasswordChallengeResponse | InitAuthPasswordSRPChallengeResponse | InitAuthMfaSetupChallengeResponse;
 export type InitiateAuthResponse = InitiateAuthAuthenticationResponse | InitiateAuthPasswordVerifierChallengeResponse | InitiateAuthChallengeResponse;
 type CognitoResponseMap = {
     [ServiceTarget.InitiateAuth]: InitiateAuthResponse;
@@ -400,9 +486,13 @@ type CognitoResponseMap = {
     [ServiceTarget.VerifySoftwareToken]: VerifySoftwareTokenResponse;
     [ServiceTarget.ListDevices]: ListDevicesResponse;
     [ServiceTarget.SetUserMFAPreference]: void;
+    [ServiceTarget.StartWebAuthnRegistration]: StartWebAuthnRegistrationResponse;
+    [ServiceTarget.CompleteWebAuthnRegistration]: void;
+    [ServiceTarget.DeleteWebAuthnCredential]: void;
+    [ServiceTarget.ListWebAuthnCredentials]: ListWebAuthnCredentialsResponse;
 };
 type CognitoRequestMap = {
-    [ServiceTarget.InitiateAuth]: InitiateAuthRequest;
+    [ServiceTarget.InitiateAuth]: _InitiateAuthRequest;
     [ServiceTarget.RespondToAuthChallenge]: _RespondToAuthChallengeRequest;
     [ServiceTarget.SignUp]: SignUpRequest;
     [ServiceTarget.ConfirmSignUp]: ConfirmSignUpRequest;
@@ -438,6 +528,10 @@ type CognitoRequestMap = {
     [ServiceTarget.VerifySoftwareToken]: VerifySoftwareTokenRequest;
     [ServiceTarget.ListDevices]: ListDevicesRequest;
     [ServiceTarget.SetUserMFAPreference]: SetUserMFAPreferenceRequest;
+    [ServiceTarget.StartWebAuthnRegistration]: StartWebAuthnRegistrationRequest;
+    [ServiceTarget.CompleteWebAuthnRegistration]: any;
+    [ServiceTarget.DeleteWebAuthnCredential]: DeleteWebAuthnCredentialRequest;
+    [ServiceTarget.ListWebAuthnCredentials]: ListWebAuthnCredentialsRequest;
 };
 export declare function adaptExpiresIn(auth: AuthenticationResult): {
     ExpiresIn: number;
@@ -458,6 +552,7 @@ export declare class CognitoClient {
     private readonly clientSecret?;
     constructor({ userPoolId, userPoolClientId, endpoint, oAuth2: oAuth, clientSecret }: CognitoClientProps);
     static getDecodedTokenFromSession(auth: AuthenticationResult): DecodedTokens;
+    initiateAuth(request: InitiateAuthRequest): Promise<InitiateAuthResponse>;
     /**
      *
      * Performs user authentication with username and password through ALLOW_USER_SRP_AUTH .
@@ -479,6 +574,19 @@ export declare class CognitoClient {
      * @throws {InitAuthError}
      */
     authenticateUser(username: string, password: string): Promise<InitiateAuthResponse>;
+    /**
+     * Initiates the authentication process for a user using a preferred challenge, such as WEB_AUTHN.
+     */
+    authenticateWebAuthn(username: string): Promise<InitiateAuthResponse>;
+    /**
+     * Registers a new WebAuthn device for the current user.
+     * This method initiates the WebAuthn registration process by requesting the necessary options from Cognito,
+     * then creates a new public key credential using the WebAuthn API, and finally
+     * completes the registration by sending the credential back to Cognito.
+     *
+     * @param accessToken Access token of the current user.
+     */
+    registerWebAuthnDevice(accessToken: string): Promise<void>;
     /**
      * Returns a new session based on the given refresh token.
      *
@@ -516,8 +624,33 @@ export declare class CognitoClient {
      * @throws {ChangePasswordError}
      */
     changePassword(currentPassword: string, newPassword: string, accessToken: string): Promise<void>;
+    /**
+     * Gets the user information.
+     * @param accessToken Access token of the current user.
+     * @returns User information.
+     */
     getUser(accessToken: string): Promise<GetUserResponse>;
+    /**
+     * Associates a software token with the user.
+     * @param params Request to associate a software token with the user.
+     * @param params.AccessToken Access token of the current user.
+     * @param params.Session Optional session identifier for the authentication process.
+     * @param params.ClientMetadata Optional metadata to pass to the service.
+     * @param params.UserContextData Optional user context data.
+     * @param params.AnalyticsMetadata Optional analytics metadata.
+     * @param params.FriendlyDeviceName Optional friendly name for the device.
+     * @returns
+     */
     associateSoftwareToken(params: AssociateSoftwareTokenRequest): Promise<AssociateSoftwareResponse>;
+    /**
+     * Verifies a software token.
+     * @param params Request to verify a software token.
+     * @param params.AccessToken Access token of the current user.
+     * @param params.FriendlyDeviceName Optional friendly name for the device.
+     * @param params.Session Optional session identifier for the authentication process.
+     * @param params.UserCode The user code to verify.
+     * @returns
+     */
     verifySoftwareToken(params: VerifySoftwareTokenRequest): Promise<VerifySoftwareTokenResponse>;
     /**
      * Responds to an authentication challenge.
@@ -602,6 +735,32 @@ export declare class CognitoClient {
      * @throws {ResendConfirmationCodeError}
      */
     resendConfirmationCode(username: string): Promise<void>;
+    startWebAuthnRegistration(request: StartWebAuthnRegistrationRequest): Promise<StartWebAuthnRegistrationResponse>;
+    /**
+     * Completes registration of a passkey authenticator for the currently signed-in user.
+     * @param request Request to complete WebAuthn registration.
+     * @param request.AccessToken Access token of the current user.
+     * @param request.Credential The credential object returned by the WebAuthn API.
+     */
+    completeWebAuthnRegistration(request: CompleteWebAuthnRegistrationRequest): Promise<void>;
+    /**
+     * Deletes a registered passkey, or WebAuthn, authenticator for the currently signed-in user.
+     *
+     * @param request Request to delete a WebAuthn credential.
+     * @param request.AccessToken Access token of the current user.
+     * @param request.CredentialId The ID of the credential to delete.
+     */
+    deleteWebAuthnCredential(request: DeleteWebAuthnCredentialRequest): Promise<void>;
+    /**
+     * Lists all registered WebAuthn credentials for the currently signed-in user.
+     *
+     * @param request Request to list WebAuthn credentials.
+     * @param request.AccessToken Access token of the current user.
+     * @param request.MaxResults Maximum number of credentials to return.
+     * @param request.NextToken Pagination token to continue listing credentials.
+     * @returns
+     */
+    listWebAuthnCredentials(request: ListWebAuthnCredentialsRequest): Promise<ListWebAuthnCredentialsResponse>;
     /**
      * Returns a link to Cognito`s Hosted UI for OAuth2 authentication.
      * This method works in conjunction with @see handleCodeFlow .

package/lib/cognito-client.js

@@ -1,5 +1,5 @@
-import { ChangePasswordError, ConfirmForgotPasswordError, ConfirmSignUpError, ForgotPasswordError, GlobalSignOutError, InitAuthError, ResendConfirmationCodeError, RespondToAuthChallengeError, RevokeTokenError, SignUpError, UpdateUserAttributesError, VerifyUserAttributeError, InitiateAuthException, COMMON_EXCEPTIONS, CommonError, VerifySoftwareTokenError } from './error.js';
-import { calculateSecretHash, calculateSignature, calculateU, decodeJwt, digest, generateA, generateSmallA, getPasswordAuthenticationKey, randomBytes, uint8ArrayFromString, uint8ArrayToBase64String } from './utils.js';
+import { ChangePasswordError, ConfirmForgotPasswordError, ConfirmSignUpError, ForgotPasswordError, GlobalSignOutError, InitAuthError, ResendConfirmationCodeError, RespondToAuthChallengeError, RevokeTokenError, SignUpError, UpdateUserAttributesError, VerifyUserAttributeError, InitiateAuthException, COMMON_EXCEPTIONS, CommonError, VerifySoftwareTokenError, AssociateSoftwareTokenError, SetUserMFAPreferenceError, ListDevicesError, GetUserError } from './error.js';
+import { base64UrlToUint8Array, calculateSecretHash, calculateSignature, calculateU, decodeJwt, digest, generateA, generateSmallA, getPasswordAuthenticationKey, publicKeyCredentialToJSON, randomBytes, uint8ArrayFromString, uint8ArrayToBase64String } from './utils.js';
 /**
  * List of used and supported Cognito API calls.
  * @see https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_Operations.html for more details
@@ -23,6 +23,10 @@ export var ServiceTarget;
     ServiceTarget["VerifySoftwareToken"] = "VerifySoftwareToken";
     ServiceTarget["ListDevices"] = "ListDevices";
     ServiceTarget["SetUserMFAPreference"] = "SetUserMFAPreference";
+    ServiceTarget["StartWebAuthnRegistration"] = "StartWebAuthnRegistration";
+    ServiceTarget["CompleteWebAuthnRegistration"] = "CompleteWebAuthnRegistration";
+    ServiceTarget["DeleteWebAuthnCredential"] = "DeleteWebAuthnCredential";
+    ServiceTarget["ListWebAuthnCredentials"] = "ListWebAuthnCredentials";
 })(ServiceTarget || (ServiceTarget = {}));
 /**
  * Cognito supported federated identities public providers.
@@ -103,14 +107,27 @@ export async function cognitoRequest(body, serviceTarget, cognitoEndpoint) {
             throw new VerifyUserAttributeError(errorMessage, cognitoException);
         case ServiceTarget.GlobalSignOut:
             throw new GlobalSignOutError(errorMessage, cognitoException);
+        case ServiceTarget.AssociateSoftwareToken:
+            throw new AssociateSoftwareTokenError(errorMessage, cognitoException);
         case ServiceTarget.VerifySoftwareToken:
             throw new VerifySoftwareTokenError(errorMessage, cognitoException);
+        case ServiceTarget.SetUserMFAPreference:
+            throw new SetUserMFAPreferenceError(errorMessage, cognitoException);
+        case ServiceTarget.ListDevices:
+            throw new ListDevicesError(errorMessage, cognitoException);
+        case ServiceTarget.GetUser:
+            throw new GetUserError(errorMessage, cognitoException);
     }
 }
 /**
  * Lightweight AWS Cogito client without any AWS SDK dependencies.
  */
 export class CognitoClient {
+    cognitoEndpoint;
+    cognitoPoolName;
+    userPoolClientId;
+    oAuth;
+    clientSecret;
     constructor({ userPoolId, userPoolClientId, endpoint, oAuth2: oAuth, clientSecret }) {
         const [cognitoPoolRegion, cognitoPoolName] = userPoolId.split('_');
         this.cognitoEndpoint = (endpoint || `https://cognito-idp.${cognitoPoolRegion}.amazonaws.com`).replace(/\/$/, '');
@@ -127,6 +144,16 @@ export class CognitoClient {
             accessToken
         };
     }
+    async initiateAuth(request) {
+        const cognitoResponse = await cognitoRequest({
+            ...request,
+            ClientId: this.userPoolClientId
+        }, ServiceTarget.InitiateAuth, this.cognitoEndpoint);
+        if (cognitoResponse.AuthenticationResult) {
+            cognitoResponse.AuthenticationResult = adaptExpiresIn(cognitoResponse.AuthenticationResult);
+        }
+        return cognitoResponse;
+    }
     /**
      *
      * Performs user authentication with username and password through ALLOW_USER_SRP_AUTH .
@@ -140,16 +167,15 @@ export class CognitoClient {
     async authenticateUserSrp(username, password) {
         const smallA = await generateSmallA();
         const A = generateA(smallA);
-        const initUserSrpAuthResponse = await cognitoRequest({
+        const initUserSrpAuthResponse = await this.initiateAuth({
             AuthFlow: 'USER_SRP_AUTH',
-            ClientId: this.userPoolClientId,
             AuthParameters: {
                 USERNAME: username,
                 SRP_A: A.toString(16),
                 SECRET_HASH: this.clientSecret && (await calculateSecretHash(this.clientSecret, this.userPoolClientId, username))
             },
             ClientMetadata: {}
-        }, ServiceTarget.InitiateAuth, this.cognitoEndpoint);
+        });
         if (initUserSrpAuthResponse.ChallengeName !== 'PASSWORD_VERIFIER') {
             return initUserSrpAuthResponse;
         }
@@ -187,7 +213,6 @@ export class CognitoClient {
     async authenticateUser(username, password) {
         const initiateAuthPayload = {
             AuthFlow: 'USER_PASSWORD_AUTH',
-            ClientId: this.userPoolClientId,
             AuthParameters: {
                 USERNAME: username,
                 PASSWORD: password,
@@ -195,13 +220,73 @@ export class CognitoClient {
             },
             ClientMetadata: {}
         };
-        const initUserPasswordAuthResponse = await cognitoRequest(initiateAuthPayload, ServiceTarget.InitiateAuth, this.cognitoEndpoint);
+        const initUserPasswordAuthResponse = await this.initiateAuth(initiateAuthPayload);
         if (!initUserPasswordAuthResponse.AuthenticationResult) {
             return initUserPasswordAuthResponse;
         }
-        initUserPasswordAuthResponse.AuthenticationResult = adaptExpiresIn(initUserPasswordAuthResponse.AuthenticationResult);
         return initUserPasswordAuthResponse;
     }
+    /**
+     * Initiates the authentication process for a user using a preferred challenge, such as WEB_AUTHN.
+     */
+    async authenticateWebAuthn(username) {
+        const webAuthnPayload = {
+            AuthFlow: 'USER_AUTH',
+            AuthParameters: {
+                USERNAME: username,
+                PREFERRED_CHALLENGE: 'WEB_AUTHN'
+            }
+        };
+        const authResponse = await this.initiateAuth(webAuthnPayload);
+        if (authResponse.ChallengeName !== 'WEB_AUTHN') {
+            throw new InitAuthError('Authentication failed, expected WEB_AUTHN challenge but received: ' + authResponse.ChallengeName, InitiateAuthException.InternalErrorException);
+        }
+        const credentialRequestOptions = JSON.parse(authResponse.ChallengeParameters.CREDENTIAL_REQUEST_OPTIONS);
+        credentialRequestOptions.challenge = base64UrlToUint8Array(credentialRequestOptions.challenge);
+        credentialRequestOptions.allowCredentials = (credentialRequestOptions.allowCredentials || []).map((allowCred) => ({
+            ...allowCred,
+            id: base64UrlToUint8Array(allowCred.id)
+        }));
+        const credentials = await navigator.credentials.get({
+            publicKey: credentialRequestOptions
+        });
+        const challengeResponse = await this.respondToAuthChallenge({
+            ChallengeName: 'WEB_AUTHN',
+            ChallengeResponses: {
+                USERNAME: username,
+                CREDENTIAL: JSON.stringify(publicKeyCredentialToJSON(credentials)),
+                SECRET_HASH: this.clientSecret && (await calculateSecretHash(this.clientSecret, this.userPoolClientId, username))
+            },
+            Session: authResponse.Session
+        });
+        if (challengeResponse.AuthenticationResult) {
+            challengeResponse.AuthenticationResult = adaptExpiresIn(challengeResponse.AuthenticationResult);
+        }
+        return challengeResponse;
+    }
+    /**
+     * Registers a new WebAuthn device for the current user.
+     * This method initiates the WebAuthn registration process by requesting the necessary options from Cognito,
+     * then creates a new public key credential using the WebAuthn API, and finally
+     * completes the registration by sending the credential back to Cognito.
+     *
+     * @param accessToken Access token of the current user.
+     */
+    async registerWebAuthnDevice(accessToken) {
+        const { CredentialCreationOptions } = await this.startWebAuthnRegistration({
+            AccessToken: accessToken
+        });
+        const credentials = await navigator.credentials.create({
+            publicKey: CredentialCreationOptions
+        });
+        if (!(credentials instanceof PublicKeyCredential)) {
+            throw new Error('Invalid credentials returned from WebAuthn API');
+        }
+        await this.completeWebAuthnRegistration({
+            AccessToken: accessToken,
+            Credential: credentials
+        });
+    }
     /**
      * Returns a new session based on the given refresh token.
      *
@@ -213,7 +298,6 @@ export class CognitoClient {
     async refreshSession(refreshToken, username) {
         const refreshTokenPayload = {
             AuthFlow: 'REFRESH_TOKEN_AUTH',
-            ClientId: this.userPoolClientId,
             AuthParameters: {
                 REFRESH_TOKEN: refreshToken,
                 SECRET_HASH: this.clientSecret &&
@@ -222,14 +306,14 @@ export class CognitoClient {
             },
             ClientMetadata: {}
         };
-        const { AuthenticationResult } = await cognitoRequest(refreshTokenPayload, ServiceTarget.InitiateAuth, this.cognitoEndpoint);
+        const { AuthenticationResult } = await this.initiateAuth(refreshTokenPayload);
         if (!AuthenticationResult) {
             throw new InitAuthError('Authentication failed, no authentication result returned', InitiateAuthException.InternalErrorException);
         }
         if (!AuthenticationResult.RefreshToken) {
             AuthenticationResult.RefreshToken = refreshToken;
         }
-        return adaptExpiresIn(AuthenticationResult);
+        return AuthenticationResult;
     }
     /**
      *
@@ -284,15 +368,40 @@ export class CognitoClient {
         };
         await cognitoRequest(changePasswordPayload, ServiceTarget.ChangePassword, this.cognitoEndpoint);
     }
+    /**
+     * Gets the user information.
+     * @param accessToken Access token of the current user.
+     * @returns User information.
+     */
     async getUser(accessToken) {
         const getUserPayload = {
             AccessToken: accessToken
         };
         return cognitoRequest(getUserPayload, ServiceTarget.GetUser, this.cognitoEndpoint);
     }
+    /**
+     * Associates a software token with the user.
+     * @param params Request to associate a software token with the user.
+     * @param params.AccessToken Access token of the current user.
+     * @param params.Session Optional session identifier for the authentication process.
+     * @param params.ClientMetadata Optional metadata to pass to the service.
+     * @param params.UserContextData Optional user context data.
+     * @param params.AnalyticsMetadata Optional analytics metadata.
+     * @param params.FriendlyDeviceName Optional friendly name for the device.
+     * @returns
+     */
     async associateSoftwareToken(params) {
         return cognitoRequest(params, ServiceTarget.AssociateSoftwareToken, this.cognitoEndpoint);
     }
+    /**
+     * Verifies a software token.
+     * @param params Request to verify a software token.
+     * @param params.AccessToken Access token of the current user.
+     * @param params.FriendlyDeviceName Optional friendly name for the device.
+     * @param params.Session Optional session identifier for the authentication process.
+     * @param params.UserCode The user code to verify.
+     * @returns
+     */
     async verifySoftwareToken(params) {
         return cognitoRequest(params, ServiceTarget.VerifySoftwareToken, this.cognitoEndpoint);
     }
@@ -431,6 +540,51 @@ export class CognitoClient {
         };
         await cognitoRequest(resendConfirmationCodeRequest, ServiceTarget.ResendConfirmationCode, this.cognitoEndpoint);
     }
+    async startWebAuthnRegistration(request) {
+        const response = await cognitoRequest(request, ServiceTarget.StartWebAuthnRegistration, this.cognitoEndpoint);
+        response.CredentialCreationOptions.challenge = base64UrlToUint8Array(response.CredentialCreationOptions.challenge);
+        response.CredentialCreationOptions.user.id = base64UrlToUint8Array(response.CredentialCreationOptions.user.id);
+        response.CredentialCreationOptions.excludeCredentials = (response.CredentialCreationOptions.excludeCredentials || []).map((excludeCred) => ({
+            ...excludeCred,
+            id: base64UrlToUint8Array(excludeCred.id)
+        }));
+        return response;
+    }
+    /**
+     * Completes registration of a passkey authenticator for the currently signed-in user.
+     * @param request Request to complete WebAuthn registration.
+     * @param request.AccessToken Access token of the current user.
+     * @param request.Credential The credential object returned by the WebAuthn API.
+     */
+    async completeWebAuthnRegistration(request) {
+        await cognitoRequest({
+            AccessToken: request.AccessToken,
+            Credential: publicKeyCredentialToJSON(request.Credential)
+        }, ServiceTarget.CompleteWebAuthnRegistration, this.cognitoEndpoint);
+    }
+    /**
+     * Deletes a registered passkey, or WebAuthn, authenticator for the currently signed-in user.
+     *
+     * @param request Request to delete a WebAuthn credential.
+     * @param request.AccessToken Access token of the current user.
+     * @param request.CredentialId The ID of the credential to delete.
+     */
+    async deleteWebAuthnCredential(request) {
+        await cognitoRequest(request, ServiceTarget.DeleteWebAuthnCredential, this.cognitoEndpoint);
+    }
+    /**
+     * Lists all registered WebAuthn credentials for the currently signed-in user.
+     *
+     * @param request Request to list WebAuthn credentials.
+     * @param request.AccessToken Access token of the current user.
+     * @param request.MaxResults Maximum number of credentials to return.
+     * @param request.NextToken Pagination token to continue listing credentials.
+     * @returns
+     */
+    async listWebAuthnCredentials(request) {
+        const response = await cognitoRequest(request, ServiceTarget.ListWebAuthnCredentials, this.cognitoEndpoint);
+        return response;
+    }
     /**
      * Returns a link to Cognito`s Hosted UI for OAuth2 authentication.
      * This method works in conjunction with @see handleCodeFlow .

package/lib/error.d.ts

@@ -362,11 +362,11 @@ export declare enum RevokeTokenException {
     UnsupportedOperationException = "UnsupportedOperationException",
     UnsupportedTokenTypeException = "UnsupportedTokenTypeException"
 }
-export type CognitoErrorType = 'CommonError' | 'InitAuthError' | 'RespondToAuthChallengeError' | 'SignUpError' | 'ConfirmSignUpError' | 'VerifySoftwareTokenError' | 'ChangePasswordError' | 'RevokeTokenError' | 'ForgotPasswordError' | 'ConfirmForgotPasswordError' | 'ResendConfirmationCodeError' | 'UpdateUserAttributesError' | 'VerifyUserAttributeError' | 'AssociateSoftwareTokenError' | 'GlobalSignOutError';
+export type CognitoErrorType = 'CommonError' | 'InitAuthError' | 'RespondToAuthChallengeError' | 'SignUpError' | 'ConfirmSignUpError' | 'VerifySoftwareTokenError' | 'ChangePasswordError' | 'RevokeTokenError' | 'ForgotPasswordError' | 'ConfirmForgotPasswordError' | 'ResendConfirmationCodeError' | 'UpdateUserAttributesError' | 'VerifyUserAttributeError' | 'AssociateSoftwareTokenError' | 'GlobalSignOutError' | 'SetUserMFAPreferenceError' | 'GetUserError' | 'ListDevicesError';
 export declare class CognitoError extends Error {
     readonly errorType: CognitoErrorType;
-    readonly cognitoException: CommonException | InitiateAuthException | RespondToAuthChallengeException | SignUpException | ConfirmSignUpException | ChangePasswordException | RevokeTokenException | ForgotPasswordException | ConfirmForgotPasswordException | ResendConfirmationException | UpdateUserAttributesException | VerifyUserAttributeException | GlobalSignOutException | VerifySoftwareTokenException | AssociateSoftwareTokenException;
-    constructor(message: string, errorType: CognitoErrorType, cognitoException: CommonException | InitiateAuthException | RespondToAuthChallengeException | SignUpException | ConfirmSignUpException | ChangePasswordException | RevokeTokenException | ForgotPasswordException | ConfirmForgotPasswordException | ResendConfirmationException | UpdateUserAttributesException | VerifyUserAttributeException | GlobalSignOutException | VerifySoftwareTokenException | AssociateSoftwareTokenException);
+    readonly cognitoException: CommonException | InitiateAuthException | RespondToAuthChallengeException | SignUpException | ConfirmSignUpException | ChangePasswordException | RevokeTokenException | ForgotPasswordException | ConfirmForgotPasswordException | ResendConfirmationException | UpdateUserAttributesException | VerifyUserAttributeException | GlobalSignOutException | VerifySoftwareTokenException | AssociateSoftwareTokenException | SetUserMFAPreferenceException | ListDevicesException | GetUserException;
+    constructor(message: string, errorType: CognitoErrorType, cognitoException: CommonException | InitiateAuthException | RespondToAuthChallengeException | SignUpException | ConfirmSignUpException | ChangePasswordException | RevokeTokenException | ForgotPasswordException | ConfirmForgotPasswordException | ResendConfirmationException | UpdateUserAttributesException | VerifyUserAttributeException | GlobalSignOutException | VerifySoftwareTokenException | AssociateSoftwareTokenException | SetUserMFAPreferenceException | ListDevicesException | GetUserException);
 }
 export declare class CommonError extends CognitoError {
     readonly cognitoException: CommonException;
@@ -428,3 +428,15 @@ export declare class AssociateSoftwareTokenError extends CognitoError {
     readonly cognitoException: AssociateSoftwareTokenException;
     constructor(message: string, cognitoException: AssociateSoftwareTokenException);
 }
+export declare class SetUserMFAPreferenceError extends CognitoError {
+    readonly cognitoException: SetUserMFAPreferenceException;
+    constructor(message: string, cognitoException: SetUserMFAPreferenceException);
+}
+export declare class ListDevicesError extends CognitoError {
+    readonly cognitoException: ListDevicesException;
+    constructor(message: string, cognitoException: ListDevicesException);
+}
+export declare class GetUserError extends CognitoError {
+    readonly cognitoException: GetUserException;
+    constructor(message: string, cognitoException: GetUserException);
+}