@vardario/cognito-client 5.2.1 → 5.3.1

package/lib/browser.js

@@ -644,6 +644,28 @@ function publicKeyCredentialToJSON(cred) {
     type: cred.type
   });
 }
+function credentialCreateOptionsToPublicKey(credentialCreateOptions) {
+  credentialCreateOptions.challenge = base64UrlToUint8Array(credentialCreateOptions.challenge);
+  credentialCreateOptions.user.id = base64UrlToUint8Array(credentialCreateOptions.user.id);
+  credentialCreateOptions.excludeCredentials = (credentialCreateOptions.excludeCredentials || []).map(
+    (excludeCred) => ({
+      ...excludeCred,
+      id: base64UrlToUint8Array(excludeCred.id)
+    })
+  );
+  return credentialCreateOptions;
+}
+function createCredentialFromInitWebAuthResponse(reposne) {
+  const credentialRequestOptions = JSON.parse(reposne.ChallengeParameters.CREDENTIAL_REQUEST_OPTIONS);
+  credentialRequestOptions.challenge = base64UrlToUint8Array(credentialRequestOptions.challenge);
+  credentialRequestOptions.allowCredentials = (credentialRequestOptions.allowCredentials || []).map(
+    (allowCred) => ({
+      ...allowCred,
+      id: base64UrlToUint8Array(allowCred.id)
+    })
+  );
+  return credentialRequestOptions;
+}
 var N = BigInt(
   "0xFFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AAAC42DAD33170D04507A33A85521ABDF1CBA64ECFB850458DBEF0A8AEA71575D060C7DB3970F85A6E1E4C7ABF5AE8CDB0933D71E8C94E04A25619DCEE3D2261AD2EE6BF12FFA06D98A0864D87602733EC86A64521F2B18177B200CBBE117577A615D6C770988C0BAD946E208E24FA074E5AB3143DB5BFCE0FD108E4B82D120A93AD2CAFFFFFFFFFFFFFFFF"
 );
@@ -809,12 +831,6 @@ var IdentityProvider = {
   Facebook: "Facebook",
   Apple: "SignInWithApple"
 };
-function adaptExpiresIn(auth) {
-  return {
-    ...auth,
-    ExpiresIn: (/* @__PURE__ */ new Date()).getTime() + auth.ExpiresIn * 1e3
-  };
-}
 async function cognitoRequest(body, serviceTarget, cognitoEndpoint) {
   const cognitoResponse = await fetch(cognitoEndpoint, {
     headers: {
@@ -902,17 +918,18 @@ var CognitoClient = class {
     };
   }
   async initiateAuth(request) {
-    const cognitoResponse = await cognitoRequest(
-      {
-        ...request,
-        ClientId: this.userPoolClientId
-      },
-      "InitiateAuth" /* InitiateAuth */,
-      this.cognitoEndpoint
-    );
-    if (cognitoResponse.AuthenticationResult) {
-      cognitoResponse.AuthenticationResult = adaptExpiresIn(cognitoResponse.AuthenticationResult);
+    const _request = {
+      ...request,
+      ClientId: this.userPoolClientId
+    };
+    if (this.clientSecret && request.AuthParameters.USERNAME) {
+      _request.AuthParameters.SECRET_HASH = await calculateSecretHash(
+        this.clientSecret,
+        this.userPoolClientId,
+        request.AuthParameters.USERNAME
+      );
     }
+    const cognitoResponse = await cognitoRequest(_request, "InitiateAuth" /* InitiateAuth */, this.cognitoEndpoint);
     return cognitoResponse;
   }
   /**
@@ -932,8 +949,7 @@ var CognitoClient = class {
       AuthFlow: "USER_SRP_AUTH",
       AuthParameters: {
         USERNAME: username,
-        SRP_A: A.toString(16),
-        SECRET_HASH: this.clientSecret && await calculateSecretHash(this.clientSecret, this.userPoolClientId, username)
+        SRP_A: A.toString(16)
       },
       ClientMetadata: {}
     });
@@ -964,20 +980,10 @@ var CognitoClient = class {
         PASSWORD_CLAIM_SECRET_BLOCK: initUserSrpAuthResponse.ChallengeParameters.SECRET_BLOCK,
         PASSWORD_CLAIM_SIGNATURE: signature,
         USERNAME: initUserSrpAuthResponse.ChallengeParameters.USER_ID_FOR_SRP,
-        TIMESTAMP: timeStamp,
-        SECRET_HASH: this.clientSecret && await calculateSecretHash(
-          this.clientSecret,
-          this.userPoolClientId,
-          initUserSrpAuthResponse.ChallengeParameters.USER_ID_FOR_SRP
-        )
+        TIMESTAMP: timeStamp
       },
       ClientMetadata: {}
     });
-    if (passwordAuthChallengeResponse.AuthenticationResult) {
-      passwordAuthChallengeResponse.AuthenticationResult = adaptExpiresIn(
-        passwordAuthChallengeResponse.AuthenticationResult
-      );
-    }
     return passwordAuthChallengeResponse;
   }
   /**
@@ -994,8 +1000,7 @@ var CognitoClient = class {
       AuthFlow: "USER_PASSWORD_AUTH",
       AuthParameters: {
         USERNAME: username,
-        PASSWORD: password,
-        SECRET_HASH: this.clientSecret && await calculateSecretHash(this.clientSecret, this.userPoolClientId, username)
+        PASSWORD: password
       },
       ClientMetadata: {}
     };
@@ -1016,36 +1021,24 @@ var CognitoClient = class {
         PREFERRED_CHALLENGE: "WEB_AUTHN"
       }
     };
-    const authResponse = await this.initiateAuth(webAuthnPayload);
-    if (authResponse.ChallengeName !== "WEB_AUTHN") {
+    const initWebAuthnReponse = await this.initiateAuth(webAuthnPayload);
+    if (initWebAuthnReponse.ChallengeName !== "WEB_AUTHN") {
       throw new InitAuthError(
-        "Authentication failed, expected WEB_AUTHN challenge but received: " + authResponse.ChallengeName,
+        "Authentication failed, expected WEB_AUTHN challenge but received: " + initWebAuthnReponse.ChallengeName,
         "InternalErrorException" /* InternalErrorException */
       );
     }
-    const credentialRequestOptions = JSON.parse(authResponse.ChallengeParameters.CREDENTIAL_REQUEST_OPTIONS);
-    credentialRequestOptions.challenge = base64UrlToUint8Array(credentialRequestOptions.challenge);
-    credentialRequestOptions.allowCredentials = (credentialRequestOptions.allowCredentials || []).map(
-      (allowCred) => ({
-        ...allowCred,
-        id: base64UrlToUint8Array(allowCred.id)
-      })
-    );
     const credentials = await navigator.credentials.get({
-      publicKey: credentialRequestOptions
+      publicKey: createCredentialFromInitWebAuthResponse(initWebAuthnReponse)
     });
     const challengeResponse = await this.respondToAuthChallenge({
       ChallengeName: "WEB_AUTHN",
       ChallengeResponses: {
         USERNAME: username,
-        CREDENTIAL: JSON.stringify(publicKeyCredentialToJSON(credentials)),
-        SECRET_HASH: this.clientSecret && await calculateSecretHash(this.clientSecret, this.userPoolClientId, username)
+        CREDENTIAL: JSON.stringify(publicKeyCredentialToJSON(credentials))
       },
-      Session: authResponse.Session
+      Session: initWebAuthnReponse.Session
     });
-    if (challengeResponse.AuthenticationResult) {
-      challengeResponse.AuthenticationResult = adaptExpiresIn(challengeResponse.AuthenticationResult);
-    }
     return challengeResponse;
   }
   /**
@@ -1061,14 +1054,14 @@ var CognitoClient = class {
       AccessToken: accessToken
     });
     const credentials = await navigator.credentials.create({
-      publicKey: CredentialCreationOptions
+      publicKey: credentialCreateOptionsToPublicKey(CredentialCreationOptions)
     });
     if (!(credentials instanceof PublicKeyCredential)) {
       throw new Error("Invalid credentials returned from WebAuthn API");
     }
     await this.completeWebAuthnRegistration({
       AccessToken: accessToken,
-      Credential: credentials
+      Credential: publicKeyCredentialToJSON(credentials)
     });
   }
   /**
@@ -1202,6 +1195,13 @@ var CognitoClient = class {
    * @returns
    */
   async respondToAuthChallenge(params) {
+    if (this.clientSecret) {
+      params.ChallengeResponses.SECRET_HASH = await calculateSecretHash(
+        this.clientSecret,
+        this.userPoolClientId,
+        params.ChallengeResponses.USERNAME
+      );
+    }
     return cognitoRequest(
       {
         ...params,
@@ -1330,30 +1330,19 @@ var CognitoClient = class {
     await cognitoRequest(resendConfirmationCodeRequest, "ResendConfirmationCode" /* ResendConfirmationCode */, this.cognitoEndpoint);
   }
   async startWebAuthnRegistration(request) {
-    const response = await cognitoRequest(request, "StartWebAuthnRegistration" /* StartWebAuthnRegistration */, this.cognitoEndpoint);
-    response.CredentialCreationOptions.challenge = base64UrlToUint8Array(
-      response.CredentialCreationOptions.challenge
-    );
-    response.CredentialCreationOptions.user.id = base64UrlToUint8Array(
-      response.CredentialCreationOptions.user.id
-    );
-    response.CredentialCreationOptions.excludeCredentials = (response.CredentialCreationOptions.excludeCredentials || []).map((excludeCred) => ({
-      ...excludeCred,
-      id: base64UrlToUint8Array(excludeCred.id)
-    }));
-    return response;
+    return cognitoRequest(request, "StartWebAuthnRegistration" /* StartWebAuthnRegistration */, this.cognitoEndpoint);
   }
   /**
    * Completes registration of a passkey authenticator for the currently signed-in user.
    * @param request Request to complete WebAuthn registration.
    * @param request.AccessToken Access token of the current user.
-   * @param request.Credential The credential object returned by the WebAuthn API.
+   * @param request.Credential The credential object returned by the WebAuthn API. You have to use publicKeyCredentialToJSON to convert the credential to a JSON object before sending it to Cognito.
    */
   async completeWebAuthnRegistration(request) {
     await cognitoRequest(
       {
         AccessToken: request.AccessToken,
-        Credential: publicKeyCredentialToJSON(request.Credential)
+        Credential: request.Credential
       },
       "CompleteWebAuthnRegistration" /* CompleteWebAuthnRegistration */,
       this.cognitoEndpoint
@@ -1454,12 +1443,12 @@ var CognitoClient = class {
     if (error) {
       throw new Error(error);
     }
-    return adaptExpiresIn({
+    return {
       AccessToken: access_token,
       RefreshToken: refresh_token,
       IdToken: id_token,
       ExpiresIn: expires_in
-    });
+    };
   }
   /**
    * Invalidates the identity, access, and refresh tokens that Amazon Cognito issued to a user. Call this operation when your user signs out of your app. This results in the following behavior.
@@ -1522,7 +1511,6 @@ export {
   VerifySoftwareTokenException,
   VerifyUserAttributeError,
   VerifyUserAttributeException,
-  adaptExpiresIn,
   base64UrlToUint8Array,
   calculateHKDF,
   calculateS,
@@ -1530,6 +1518,8 @@ export {
   calculateSignature,
   calculateU,
   cognitoRequest,
+  createCredentialFromInitWebAuthResponse,
+  credentialCreateOptionsToPublicKey,
   decodeJwt,
   digest,
   formatTimestamp,

package/lib/cognito-client.d.ts

@@ -140,8 +140,16 @@ export interface _RespondToAuthChallengeWebAuthnRequest extends RespondToAuthCha
         SECRET_HASH?: string;
     };
 }
-type _RespondToAuthChallengeRequest = _RespondToAuthChallengePasswordVerifierRequest | _RespondToAuthChallengeSmsMfaRequest | _RespondToAuthChallengeCustomChallengeNameRequest | _RespondToAuthChallengeNewPasswordRequiredRequest | _RespondToAuthChallengeSoftwareTokenMfaRequest | _RespondToAuthChallengeDeviceSrpAuthRequest | _RespondToAuthChallengeDevicePasswordVerifierRequest | _RespondToAuthChallengeMfaSetupRequest | _RespondToAuthChallengeSelectMfaTypeRequest | _RespondToAuthChallengeWebAuthnRequest;
-export type RespondToAuthChallengeRequest = Omit<_RespondToAuthChallengePasswordVerifierRequest, 'ClientId'> | Omit<_RespondToAuthChallengeSmsMfaRequest, 'ClientId'> | Omit<_RespondToAuthChallengeCustomChallengeNameRequest, 'ClientId'> | Omit<_RespondToAuthChallengeNewPasswordRequiredRequest, 'ClientId'> | Omit<_RespondToAuthChallengeSoftwareTokenMfaRequest, 'ClientId'> | Omit<_RespondToAuthChallengeDeviceSrpAuthRequest, 'ClientId'> | Omit<_RespondToAuthChallengeDevicePasswordVerifierRequest, 'ClientId'> | Omit<_RespondToAuthChallengeMfaSetupRequest, 'ClientId'> | Omit<_RespondToAuthChallengeSelectMfaTypeRequest, 'ClientId'> | Omit<_RespondToAuthChallengeWebAuthnRequest, 'ClientId'>;
+export interface _RespondToAuthChallengeEmailOtpRequest extends RespondToAuthChallengeBaseRequest {
+    ChallengeName: 'EMAIL_OTP';
+    ChallengeResponses: {
+        SECRET_HASH?: string;
+        EMAIL_OTP_CODE: string;
+        USERNAME: string;
+    };
+}
+type _RespondToAuthChallengeRequest = _RespondToAuthChallengePasswordVerifierRequest | _RespondToAuthChallengeSmsMfaRequest | _RespondToAuthChallengeCustomChallengeNameRequest | _RespondToAuthChallengeNewPasswordRequiredRequest | _RespondToAuthChallengeSoftwareTokenMfaRequest | _RespondToAuthChallengeDeviceSrpAuthRequest | _RespondToAuthChallengeDevicePasswordVerifierRequest | _RespondToAuthChallengeMfaSetupRequest | _RespondToAuthChallengeSelectMfaTypeRequest | _RespondToAuthChallengeWebAuthnRequest | _RespondToAuthChallengeEmailOtpRequest;
+export type RespondToAuthChallengeRequest = Omit<_RespondToAuthChallengePasswordVerifierRequest, 'ClientId'> | Omit<_RespondToAuthChallengeSmsMfaRequest, 'ClientId'> | Omit<_RespondToAuthChallengeCustomChallengeNameRequest, 'ClientId'> | Omit<_RespondToAuthChallengeNewPasswordRequiredRequest, 'ClientId'> | Omit<_RespondToAuthChallengeSoftwareTokenMfaRequest, 'ClientId'> | Omit<_RespondToAuthChallengeDeviceSrpAuthRequest, 'ClientId'> | Omit<_RespondToAuthChallengeDevicePasswordVerifierRequest, 'ClientId'> | Omit<_RespondToAuthChallengeMfaSetupRequest, 'ClientId'> | Omit<_RespondToAuthChallengeSelectMfaTypeRequest, 'ClientId'> | Omit<_RespondToAuthChallengeWebAuthnRequest, 'ClientId'> | Omit<_RespondToAuthChallengeEmailOtpRequest, 'ClientId'>;
 export interface UserAttribute {
     Name: string;
     Value: string;
@@ -404,6 +412,15 @@ export interface InitAuthMfaSetupChallengeResponse extends InitiateAuthBaseRespo
     ChallengeParameters: never;
     MFAS_CAN_SETUP: ('SMS_MFA' | 'SOFTWARE_TOKEN_MFA')[];
 }
+export interface InitAuthEmailOtpChallengeResponse extends InitiateAuthBaseResponse {
+    AuthenticationResult?: never;
+    ChallengeName: 'EMAIL_OTP';
+    ChallengeParameters: {
+        CODE_DELIVERY_DELIVERY_MEDIUM: string;
+        CODE_DELIVERY_DESTINATION: string;
+    };
+    Session: string;
+}
 export interface MfaOption {
     DeliveryMedium: 'SMS' | 'EMAIL';
     AttributeName: string;
@@ -438,7 +455,7 @@ export interface StartWebAuthnRegistrationResponse {
 }
 export interface CompleteWebAuthnRegistrationRequest {
     AccessToken: string;
-    Credential: PublicKeyCredential;
+    Credential: any;
 }
 export interface DeleteWebAuthnCredentialRequest {
     AccessToken: string;
@@ -451,7 +468,7 @@ export interface ListWebAuthnCredentialsRequest {
 }
 export interface WebAuthnCredential {
     AuthenticatorTransports: string[];
-    CreatedAt: string;
+    CreatedAt: number;
     CredentialId: string;
     FriendlyCredentialName: string;
     RelyingPartyId: string;
@@ -461,7 +478,7 @@ export interface ListWebAuthnCredentialsResponse {
     Credentials: WebAuthnCredential[];
     NextToken?: string;
 }
-export type InitiateAuthChallengeResponse = InitiateAuthPasswordVerifierChallengeResponse | InitiateAuthSoftwareTokenMfaChallengeResponse | InitiateAuthWebAuthResponse | InitiateEmailOtpChallengeResponse | InitAuthSelectChallengeResponse | InitAuthPasswordChallengeResponse | InitAuthPasswordSRPChallengeResponse | InitAuthMfaSetupChallengeResponse;
+export type InitiateAuthChallengeResponse = InitiateAuthPasswordVerifierChallengeResponse | InitiateAuthSoftwareTokenMfaChallengeResponse | InitiateAuthWebAuthResponse | InitiateEmailOtpChallengeResponse | InitAuthSelectChallengeResponse | InitAuthPasswordChallengeResponse | InitAuthPasswordSRPChallengeResponse | InitAuthMfaSetupChallengeResponse | InitAuthEmailOtpChallengeResponse;
 export type InitiateAuthResponse = InitiateAuthAuthenticationResponse | InitiateAuthPasswordVerifierChallengeResponse | InitiateAuthChallengeResponse;
 type CognitoResponseMap = {
     [ServiceTarget.InitiateAuth]: InitiateAuthResponse;
@@ -531,13 +548,6 @@ type CognitoRequestMap = {
     [ServiceTarget.DeleteWebAuthnCredential]: DeleteWebAuthnCredentialRequest;
     [ServiceTarget.ListWebAuthnCredentials]: ListWebAuthnCredentialsRequest;
 };
-export declare function adaptExpiresIn(auth: AuthenticationResult): {
-    ExpiresIn: number;
-    AccessToken: string;
-    IdToken: string;
-    RefreshToken: string;
-    NewDeviceMetadata?: NewDeviceMetadata | undefined;
-};
 export declare function cognitoRequest<T extends ServiceTarget>(body: CognitoRequestMap[T], serviceTarget: T, cognitoEndpoint: string): Promise<CognitoResponseMap[T]>;
 /**
  * Lightweight AWS Cogito client without any AWS SDK dependencies.
@@ -738,7 +748,7 @@ export declare class CognitoClient {
      * Completes registration of a passkey authenticator for the currently signed-in user.
      * @param request Request to complete WebAuthn registration.
      * @param request.AccessToken Access token of the current user.
-     * @param request.Credential The credential object returned by the WebAuthn API.
+     * @param request.Credential The credential object returned by the WebAuthn API. You have to use publicKeyCredentialToJSON to convert the credential to a JSON object before sending it to Cognito.
      */
     completeWebAuthnRegistration(request: CompleteWebAuthnRegistrationRequest): Promise<void>;
     /**

package/lib/cognito-client.js

@@ -1,5 +1,5 @@
 import { ChangePasswordError, ConfirmForgotPasswordError, ConfirmSignUpError, ForgotPasswordError, GlobalSignOutError, InitAuthError, ResendConfirmationCodeError, RespondToAuthChallengeError, RevokeTokenError, SignUpError, UpdateUserAttributesError, VerifyUserAttributeError, InitiateAuthException, COMMON_EXCEPTIONS, CommonError, VerifySoftwareTokenError, AssociateSoftwareTokenError, SetUserMFAPreferenceError, ListDevicesError, GetUserError } from './error.js';
-import { base64UrlToUint8Array, calculateSecretHash, calculateSignature, calculateU, decodeJwt, digest, generateA, generateSmallA, getPasswordAuthenticationKey, publicKeyCredentialToJSON, randomBytes, uint8ArrayFromString, uint8ArrayToBase64String } from './utils.js';
+import { calculateSecretHash, calculateSignature, calculateU, createCredentialFromInitWebAuthResponse, credentialCreateOptionsToPublicKey, decodeJwt, digest, generateA, generateSmallA, getPasswordAuthenticationKey, publicKeyCredentialToJSON, randomBytes, uint8ArrayFromString, uint8ArrayToBase64String } from './utils.js';
 /**
  * List of used and supported Cognito API calls.
  * @see https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_Operations.html for more details
@@ -37,13 +37,6 @@ export const IdentityProvider = {
     Facebook: 'Facebook',
     Apple: 'SignInWithApple'
 };
-export function adaptExpiresIn(auth) {
-    // Cognito returns expiresIn in seconds, but we want it in milliseconds from now
-    return {
-        ...auth,
-        ExpiresIn: new Date().getTime() + auth.ExpiresIn * 1000
-    };
-}
 export async function cognitoRequest(body, serviceTarget, cognitoEndpoint) {
     const cognitoResponse = await fetch(cognitoEndpoint, {
         headers: {
@@ -142,13 +135,14 @@ export class CognitoClient {
         };
     }
     async initiateAuth(request) {
-        const cognitoResponse = await cognitoRequest({
+        const _request = {
             ...request,
             ClientId: this.userPoolClientId
-        }, ServiceTarget.InitiateAuth, this.cognitoEndpoint);
-        if (cognitoResponse.AuthenticationResult) {
-            cognitoResponse.AuthenticationResult = adaptExpiresIn(cognitoResponse.AuthenticationResult);
+        };
+        if (this.clientSecret && request.AuthParameters.USERNAME) {
+            _request.AuthParameters.SECRET_HASH = await calculateSecretHash(this.clientSecret, this.userPoolClientId, request.AuthParameters.USERNAME);
         }
+        const cognitoResponse = await cognitoRequest(_request, ServiceTarget.InitiateAuth, this.cognitoEndpoint);
         return cognitoResponse;
     }
     /**
@@ -168,8 +162,7 @@ export class CognitoClient {
             AuthFlow: 'USER_SRP_AUTH',
             AuthParameters: {
                 USERNAME: username,
-                SRP_A: A.toString(16),
-                SECRET_HASH: this.clientSecret && (await calculateSecretHash(this.clientSecret, this.userPoolClientId, username))
+                SRP_A: A.toString(16)
             },
             ClientMetadata: {}
         });
@@ -187,15 +180,10 @@ export class CognitoClient {
                 PASSWORD_CLAIM_SECRET_BLOCK: initUserSrpAuthResponse.ChallengeParameters.SECRET_BLOCK,
                 PASSWORD_CLAIM_SIGNATURE: signature,
                 USERNAME: initUserSrpAuthResponse.ChallengeParameters.USER_ID_FOR_SRP,
-                TIMESTAMP: timeStamp,
-                SECRET_HASH: this.clientSecret &&
-                    (await calculateSecretHash(this.clientSecret, this.userPoolClientId, initUserSrpAuthResponse.ChallengeParameters.USER_ID_FOR_SRP))
+                TIMESTAMP: timeStamp
             },
             ClientMetadata: {}
         });
-        if (passwordAuthChallengeResponse.AuthenticationResult) {
-            passwordAuthChallengeResponse.AuthenticationResult = adaptExpiresIn(passwordAuthChallengeResponse.AuthenticationResult);
-        }
         return passwordAuthChallengeResponse;
     }
     /**
@@ -212,8 +200,7 @@ export class CognitoClient {
             AuthFlow: 'USER_PASSWORD_AUTH',
             AuthParameters: {
                 USERNAME: username,
-                PASSWORD: password,
-                SECRET_HASH: this.clientSecret && (await calculateSecretHash(this.clientSecret, this.userPoolClientId, username))
+                PASSWORD: password
             },
             ClientMetadata: {}
         };
@@ -234,31 +221,21 @@ export class CognitoClient {
                 PREFERRED_CHALLENGE: 'WEB_AUTHN'
             }
         };
-        const authResponse = await this.initiateAuth(webAuthnPayload);
-        if (authResponse.ChallengeName !== 'WEB_AUTHN') {
-            throw new InitAuthError('Authentication failed, expected WEB_AUTHN challenge but received: ' + authResponse.ChallengeName, InitiateAuthException.InternalErrorException);
+        const initWebAuthnReponse = await this.initiateAuth(webAuthnPayload);
+        if (initWebAuthnReponse.ChallengeName !== 'WEB_AUTHN') {
+            throw new InitAuthError('Authentication failed, expected WEB_AUTHN challenge but received: ' + initWebAuthnReponse.ChallengeName, InitiateAuthException.InternalErrorException);
         }
-        const credentialRequestOptions = JSON.parse(authResponse.ChallengeParameters.CREDENTIAL_REQUEST_OPTIONS);
-        credentialRequestOptions.challenge = base64UrlToUint8Array(credentialRequestOptions.challenge);
-        credentialRequestOptions.allowCredentials = (credentialRequestOptions.allowCredentials || []).map((allowCred) => ({
-            ...allowCred,
-            id: base64UrlToUint8Array(allowCred.id)
-        }));
         const credentials = await navigator.credentials.get({
-            publicKey: credentialRequestOptions
+            publicKey: createCredentialFromInitWebAuthResponse(initWebAuthnReponse)
         });
         const challengeResponse = await this.respondToAuthChallenge({
             ChallengeName: 'WEB_AUTHN',
             ChallengeResponses: {
                 USERNAME: username,
-                CREDENTIAL: JSON.stringify(publicKeyCredentialToJSON(credentials)),
-                SECRET_HASH: this.clientSecret && (await calculateSecretHash(this.clientSecret, this.userPoolClientId, username))
+                CREDENTIAL: JSON.stringify(publicKeyCredentialToJSON(credentials))
             },
-            Session: authResponse.Session
+            Session: initWebAuthnReponse.Session
         });
-        if (challengeResponse.AuthenticationResult) {
-            challengeResponse.AuthenticationResult = adaptExpiresIn(challengeResponse.AuthenticationResult);
-        }
         return challengeResponse;
     }
     /**
@@ -274,14 +251,14 @@ export class CognitoClient {
             AccessToken: accessToken
         });
         const credentials = await navigator.credentials.create({
-            publicKey: CredentialCreationOptions
+            publicKey: credentialCreateOptionsToPublicKey(CredentialCreationOptions)
         });
         if (!(credentials instanceof PublicKeyCredential)) {
             throw new Error('Invalid credentials returned from WebAuthn API');
         }
         await this.completeWebAuthnRegistration({
             AccessToken: accessToken,
-            Credential: credentials
+            Credential: publicKeyCredentialToJSON(credentials)
         });
     }
     /**
@@ -414,6 +391,9 @@ export class CognitoClient {
      * @returns
      */
     async respondToAuthChallenge(params) {
+        if (this.clientSecret) {
+            params.ChallengeResponses.SECRET_HASH = await calculateSecretHash(this.clientSecret, this.userPoolClientId, params.ChallengeResponses.USERNAME);
+        }
         return cognitoRequest({
             ...params,
             ClientId: this.userPoolClientId
@@ -538,25 +518,18 @@ export class CognitoClient {
         await cognitoRequest(resendConfirmationCodeRequest, ServiceTarget.ResendConfirmationCode, this.cognitoEndpoint);
     }
     async startWebAuthnRegistration(request) {
-        const response = await cognitoRequest(request, ServiceTarget.StartWebAuthnRegistration, this.cognitoEndpoint);
-        response.CredentialCreationOptions.challenge = base64UrlToUint8Array(response.CredentialCreationOptions.challenge);
-        response.CredentialCreationOptions.user.id = base64UrlToUint8Array(response.CredentialCreationOptions.user.id);
-        response.CredentialCreationOptions.excludeCredentials = (response.CredentialCreationOptions.excludeCredentials || []).map((excludeCred) => ({
-            ...excludeCred,
-            id: base64UrlToUint8Array(excludeCred.id)
-        }));
-        return response;
+        return cognitoRequest(request, ServiceTarget.StartWebAuthnRegistration, this.cognitoEndpoint);
     }
     /**
      * Completes registration of a passkey authenticator for the currently signed-in user.
      * @param request Request to complete WebAuthn registration.
      * @param request.AccessToken Access token of the current user.
-     * @param request.Credential The credential object returned by the WebAuthn API.
+     * @param request.Credential The credential object returned by the WebAuthn API. You have to use publicKeyCredentialToJSON to convert the credential to a JSON object before sending it to Cognito.
      */
     async completeWebAuthnRegistration(request) {
         await cognitoRequest({
             AccessToken: request.AccessToken,
-            Credential: publicKeyCredentialToJSON(request.Credential)
+            Credential: request.Credential
         }, ServiceTarget.CompleteWebAuthnRegistration, this.cognitoEndpoint);
     }
     /**
@@ -657,12 +630,12 @@ export class CognitoClient {
         if (error) {
             throw new Error(error);
         }
-        return adaptExpiresIn({
+        return {
             AccessToken: access_token,
             RefreshToken: refresh_token,
             IdToken: id_token,
             ExpiresIn: expires_in
-        });
+        };
     }
     /**
      * Invalidates the identity, access, and refresh tokens that Amazon Cognito issued to a user. Call this operation when your user signs out of your app. This results in the following behavior.

package/lib/utils.d.ts

@@ -1,5 +1,6 @@
 /// <reference types="node" resolution-mode="require"/>
 /// <reference types="node" resolution-mode="require"/>
+import { InitiateAuthWebAuthResponse } from './cognito-client.js';
 export declare function uint8ArrayFromHexString(hexString: string): Uint8Array;
 export declare function uint8ArrayFromString(str: string): Uint8Array;
 export declare function uint8ArrayFromBase64String(str: string): Uint8Array;
@@ -8,6 +9,8 @@ export declare function uint8ArrayToBase64String(bytes: Uint8Array | ArrayBuffer
 export declare function uint8ArrayToBase64UrlString(bytes: Uint8Array | ArrayBuffer | undefined): string | undefined;
 export declare function base64UrlToUint8Array(base64: string): Uint8Array;
 export declare function publicKeyCredentialToJSON(cred: any): any;
+export declare function credentialCreateOptionsToPublicKey(credentialCreateOptions: any): PublicKeyCredentialCreationOptions;
+export declare function createCredentialFromInitWebAuthResponse(reposne: InitiateAuthWebAuthResponse): PublicKeyCredentialCreationOptions;
 export declare function padHex(bigInt: bigint): string;
 export declare function hashHexString(str: string): Promise<string>;
 export declare function hashBuffer(buffer: Uint8Array): Promise<string>;

package/lib/utils.js

@@ -63,6 +63,24 @@ export function publicKeyCredentialToJSON(cred) {
         type: cred.type
     });
 }
+export function credentialCreateOptionsToPublicKey(credentialCreateOptions) {
+    credentialCreateOptions.challenge = base64UrlToUint8Array(credentialCreateOptions.challenge);
+    credentialCreateOptions.user.id = base64UrlToUint8Array(credentialCreateOptions.user.id);
+    credentialCreateOptions.excludeCredentials = (credentialCreateOptions.excludeCredentials || []).map((excludeCred) => ({
+        ...excludeCred,
+        id: base64UrlToUint8Array(excludeCred.id)
+    }));
+    return credentialCreateOptions;
+}
+export function createCredentialFromInitWebAuthResponse(reposne) {
+    const credentialRequestOptions = JSON.parse(reposne.ChallengeParameters.CREDENTIAL_REQUEST_OPTIONS);
+    credentialRequestOptions.challenge = base64UrlToUint8Array(credentialRequestOptions.challenge);
+    credentialRequestOptions.allowCredentials = (credentialRequestOptions.allowCredentials || []).map((allowCred) => ({
+        ...allowCred,
+        id: base64UrlToUint8Array(allowCred.id)
+    }));
+    return credentialRequestOptions;
+}
 const N = BigInt('0xFFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD1' +
     '29024E088A67CC74020BBEA63B139B22514A08798E3404DD' +
     'EF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245' +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vardario/cognito-client",
-  "version": "5.2.1",
+  "version": "5.3.1",
   "description": "",
   "license": "MIT",
   "author": "Sahin Vardar",
@@ -40,7 +40,7 @@
     "lint-staged": "^16.1.4",
     "prettier": "^3.1.0",
     "prettier-package-json": "^2.8.0",
-    "semantic-release": "^24.2.7",
+    "semantic-release": "^25.0.3",
     "testcontainers": "^11.5.1",
     "tsx": "^4.7.1",
     "typescript": "^5.2.2",
@@ -54,7 +54,7 @@
     ],
     "package.json": "prettier-package-json --write"
   },
-  "packageManager": "pnpm@8.10.5",
+  "packageManager": "pnpm@9.1.0",
   "release": {
     "branches": [
       "release"