@vardario/cognito-client 5.3.0 → 6.0.0

package/lib/browser.js

@@ -644,6 +644,28 @@ function publicKeyCredentialToJSON(cred) {
     type: cred.type
   });
 }
+function credentialCreateOptionsToPublicKey(credentialCreateOptions) {
+  credentialCreateOptions.challenge = base64UrlToUint8Array(credentialCreateOptions.challenge);
+  credentialCreateOptions.user.id = base64UrlToUint8Array(credentialCreateOptions.user.id);
+  credentialCreateOptions.excludeCredentials = (credentialCreateOptions.excludeCredentials || []).map(
+    (excludeCred) => ({
+      ...excludeCred,
+      id: base64UrlToUint8Array(excludeCred.id)
+    })
+  );
+  return credentialCreateOptions;
+}
+function createCredentialFromInitWebAuthResponse(reposne) {
+  const credentialRequestOptions = JSON.parse(reposne.ChallengeParameters.CREDENTIAL_REQUEST_OPTIONS);
+  credentialRequestOptions.challenge = base64UrlToUint8Array(credentialRequestOptions.challenge);
+  credentialRequestOptions.allowCredentials = (credentialRequestOptions.allowCredentials || []).map(
+    (allowCred) => ({
+      ...allowCred,
+      id: base64UrlToUint8Array(allowCred.id)
+    })
+  );
+  return credentialRequestOptions;
+}
 var N = BigInt(
   "0xFFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AAAC42DAD33170D04507A33A85521ABDF1CBA64ECFB850458DBEF0A8AEA71575D060C7DB3970F85A6E1E4C7ABF5AE8CDB0933D71E8C94E04A25619DCEE3D2261AD2EE6BF12FFA06D98A0864D87602733EC86A64521F2B18177B200CBBE117577A615D6C770988C0BAD946E208E24FA074E5AB3143DB5BFCE0FD108E4B82D120A93AD2CAFFFFFFFFFFFFFFFF"
 );
@@ -809,12 +831,6 @@ var IdentityProvider = {
   Facebook: "Facebook",
   Apple: "SignInWithApple"
 };
-function adaptExpiresIn(auth) {
-  return {
-    ...auth,
-    ExpiresIn: (/* @__PURE__ */ new Date()).getTime() + auth.ExpiresIn * 1e3
-  };
-}
 async function cognitoRequest(body, serviceTarget, cognitoEndpoint) {
   const cognitoResponse = await fetch(cognitoEndpoint, {
     headers: {
@@ -881,17 +897,17 @@ async function cognitoRequest(body, serviceTarget, cognitoEndpoint) {
 }
 var CognitoClient = class {
   cognitoEndpoint;
+  cognitoDomain;
   cognitoPoolName;
   userPoolClientId;
-  oAuth;
   clientSecret;
-  constructor({ userPoolId, userPoolClientId, endpoint, oAuth2: oAuth, clientSecret }) {
+  constructor({ userPoolId, userPoolClientId, endpoint, clientSecret, cognitoDomain }) {
     const [cognitoPoolRegion, cognitoPoolName] = userPoolId.split("_");
     this.cognitoEndpoint = (endpoint || `https://cognito-idp.${cognitoPoolRegion}.amazonaws.com`).replace(/\/$/, "");
     this.cognitoPoolName = cognitoPoolName;
     this.userPoolClientId = userPoolClientId;
-    this.oAuth = oAuth;
     this.clientSecret = clientSecret;
+    this.cognitoDomain = cognitoDomain;
   }
   static getDecodedTokenFromSession(auth) {
     const { payload: idToken } = decodeJwt(auth.IdToken);
@@ -902,17 +918,18 @@ var CognitoClient = class {
     };
   }
   async initiateAuth(request) {
-    const cognitoResponse = await cognitoRequest(
-      {
-        ...request,
-        ClientId: this.userPoolClientId
-      },
-      "InitiateAuth" /* InitiateAuth */,
-      this.cognitoEndpoint
-    );
-    if (cognitoResponse.AuthenticationResult) {
-      cognitoResponse.AuthenticationResult = adaptExpiresIn(cognitoResponse.AuthenticationResult);
+    const _request = {
+      ...request,
+      ClientId: this.userPoolClientId
+    };
+    if (this.clientSecret && request.AuthParameters.USERNAME) {
+      _request.AuthParameters.SECRET_HASH = await calculateSecretHash(
+        this.clientSecret,
+        this.userPoolClientId,
+        request.AuthParameters.USERNAME
+      );
     }
+    const cognitoResponse = await cognitoRequest(_request, "InitiateAuth" /* InitiateAuth */, this.cognitoEndpoint);
     return cognitoResponse;
   }
   /**
@@ -932,8 +949,7 @@ var CognitoClient = class {
       AuthFlow: "USER_SRP_AUTH",
       AuthParameters: {
         USERNAME: username,
-        SRP_A: A.toString(16),
-        SECRET_HASH: this.clientSecret && await calculateSecretHash(this.clientSecret, this.userPoolClientId, username)
+        SRP_A: A.toString(16)
       },
       ClientMetadata: {}
     });
@@ -964,20 +980,10 @@ var CognitoClient = class {
         PASSWORD_CLAIM_SECRET_BLOCK: initUserSrpAuthResponse.ChallengeParameters.SECRET_BLOCK,
         PASSWORD_CLAIM_SIGNATURE: signature,
         USERNAME: initUserSrpAuthResponse.ChallengeParameters.USER_ID_FOR_SRP,
-        TIMESTAMP: timeStamp,
-        SECRET_HASH: this.clientSecret && await calculateSecretHash(
-          this.clientSecret,
-          this.userPoolClientId,
-          initUserSrpAuthResponse.ChallengeParameters.USER_ID_FOR_SRP
-        )
+        TIMESTAMP: timeStamp
       },
       ClientMetadata: {}
     });
-    if (passwordAuthChallengeResponse.AuthenticationResult) {
-      passwordAuthChallengeResponse.AuthenticationResult = adaptExpiresIn(
-        passwordAuthChallengeResponse.AuthenticationResult
-      );
-    }
     return passwordAuthChallengeResponse;
   }
   /**
@@ -994,8 +1000,7 @@ var CognitoClient = class {
       AuthFlow: "USER_PASSWORD_AUTH",
       AuthParameters: {
         USERNAME: username,
-        PASSWORD: password,
-        SECRET_HASH: this.clientSecret && await calculateSecretHash(this.clientSecret, this.userPoolClientId, username)
+        PASSWORD: password
       },
       ClientMetadata: {}
     };
@@ -1016,36 +1021,24 @@ var CognitoClient = class {
         PREFERRED_CHALLENGE: "WEB_AUTHN"
       }
     };
-    const authResponse = await this.initiateAuth(webAuthnPayload);
-    if (authResponse.ChallengeName !== "WEB_AUTHN") {
+    const initWebAuthnReponse = await this.initiateAuth(webAuthnPayload);
+    if (initWebAuthnReponse.ChallengeName !== "WEB_AUTHN") {
       throw new InitAuthError(
-        "Authentication failed, expected WEB_AUTHN challenge but received: " + authResponse.ChallengeName,
+        "Authentication failed, expected WEB_AUTHN challenge but received: " + initWebAuthnReponse.ChallengeName,
         "InternalErrorException" /* InternalErrorException */
       );
     }
-    const credentialRequestOptions = JSON.parse(authResponse.ChallengeParameters.CREDENTIAL_REQUEST_OPTIONS);
-    credentialRequestOptions.challenge = base64UrlToUint8Array(credentialRequestOptions.challenge);
-    credentialRequestOptions.allowCredentials = (credentialRequestOptions.allowCredentials || []).map(
-      (allowCred) => ({
-        ...allowCred,
-        id: base64UrlToUint8Array(allowCred.id)
-      })
-    );
     const credentials = await navigator.credentials.get({
-      publicKey: credentialRequestOptions
+      publicKey: createCredentialFromInitWebAuthResponse(initWebAuthnReponse)
     });
     const challengeResponse = await this.respondToAuthChallenge({
       ChallengeName: "WEB_AUTHN",
       ChallengeResponses: {
         USERNAME: username,
-        CREDENTIAL: JSON.stringify(publicKeyCredentialToJSON(credentials)),
-        SECRET_HASH: this.clientSecret && await calculateSecretHash(this.clientSecret, this.userPoolClientId, username)
+        CREDENTIAL: JSON.stringify(publicKeyCredentialToJSON(credentials))
       },
-      Session: authResponse.Session
+      Session: initWebAuthnReponse.Session
     });
-    if (challengeResponse.AuthenticationResult) {
-      challengeResponse.AuthenticationResult = adaptExpiresIn(challengeResponse.AuthenticationResult);
-    }
     return challengeResponse;
   }
   /**
@@ -1061,14 +1054,14 @@ var CognitoClient = class {
       AccessToken: accessToken
     });
     const credentials = await navigator.credentials.create({
-      publicKey: CredentialCreationOptions
+      publicKey: credentialCreateOptionsToPublicKey(CredentialCreationOptions)
     });
     if (!(credentials instanceof PublicKeyCredential)) {
       throw new Error("Invalid credentials returned from WebAuthn API");
     }
     await this.completeWebAuthnRegistration({
       AccessToken: accessToken,
-      Credential: credentials
+      Credential: publicKeyCredentialToJSON(credentials)
     });
   }
   /**
@@ -1202,7 +1195,7 @@ var CognitoClient = class {
    * @returns
    */
   async respondToAuthChallenge(params) {
-    if (this.clientSecret && !params.ChallengeResponses.SECRET_HASH) {
+    if (this.clientSecret) {
       params.ChallengeResponses.SECRET_HASH = await calculateSecretHash(
         this.clientSecret,
         this.userPoolClientId,
@@ -1337,30 +1330,19 @@ var CognitoClient = class {
     await cognitoRequest(resendConfirmationCodeRequest, "ResendConfirmationCode" /* ResendConfirmationCode */, this.cognitoEndpoint);
   }
   async startWebAuthnRegistration(request) {
-    const response = await cognitoRequest(request, "StartWebAuthnRegistration" /* StartWebAuthnRegistration */, this.cognitoEndpoint);
-    response.CredentialCreationOptions.challenge = base64UrlToUint8Array(
-      response.CredentialCreationOptions.challenge
-    );
-    response.CredentialCreationOptions.user.id = base64UrlToUint8Array(
-      response.CredentialCreationOptions.user.id
-    );
-    response.CredentialCreationOptions.excludeCredentials = (response.CredentialCreationOptions.excludeCredentials || []).map((excludeCred) => ({
-      ...excludeCred,
-      id: base64UrlToUint8Array(excludeCred.id)
-    }));
-    return response;
+    return cognitoRequest(request, "StartWebAuthnRegistration" /* StartWebAuthnRegistration */, this.cognitoEndpoint);
   }
   /**
    * Completes registration of a passkey authenticator for the currently signed-in user.
    * @param request Request to complete WebAuthn registration.
    * @param request.AccessToken Access token of the current user.
-   * @param request.Credential The credential object returned by the WebAuthn API.
+   * @param request.Credential The credential object returned by the WebAuthn API. You have to use publicKeyCredentialToJSON to convert the credential to a JSON object before sending it to Cognito.
    */
   async completeWebAuthnRegistration(request) {
     await cognitoRequest(
       {
         AccessToken: request.AccessToken,
-        Credential: publicKeyCredentialToJSON(request.Credential)
+        Credential: request.Credential
       },
       "CompleteWebAuthnRegistration" /* CompleteWebAuthnRegistration */,
       this.cognitoEndpoint
@@ -1398,24 +1380,25 @@ var CognitoClient = class {
    *
    * @throws {Error}
    */
-  async generateOAuthSignInUrl(identityProvider) {
-    if (this.oAuth === void 0) {
-      throw Error("You have to define oAuth options to use generateFederatedSignUrl");
-    }
+  async generateOAuthSignInUrl({
+    identityProvider,
+    redirectUri,
+    scope
+  }) {
     const state = (await randomBytes(32)).toString("hex");
     const pkce = (await randomBytes(128)).toString("hex");
     const code_challenge = uint8ArrayToBase64String(await digest("SHA-256", uint8ArrayFromString(pkce))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
     const queryParams = new URLSearchParams();
-    queryParams.append("redirect_uri", this.oAuth.redirectUrl);
-    queryParams.append("response_type", this.oAuth.responseType);
+    queryParams.append("redirect_uri", redirectUri);
+    queryParams.append("response_type", "code");
     queryParams.append("client_id", this.userPoolClientId);
     identityProvider && queryParams.append("identity_provider", identityProvider);
-    queryParams.append("scope", this.oAuth.scopes.join(" "));
+    queryParams.append("scope", scope.join(" "));
     queryParams.append("state", state);
     queryParams.append("code_challenge", code_challenge);
     queryParams.append("code_challenge_method", "S256");
     return {
-      url: `${this.oAuth.cognitoDomain}/oauth2/authorize?${queryParams.toString()}`,
+      url: `${this.cognitoDomain}/oauth2/authorize?${queryParams.toString()}`,
       state,
       pkce
     };
@@ -1431,15 +1414,20 @@ var CognitoClient = class {
    *
    * @throws {Error}
    */
-  async handleCodeFlow(returnUrl, pkce, state) {
-    if (this.oAuth === void 0) {
-      throw Error("You have to define oAuth options to use handleCodeFlow");
-    }
+  async handleCodeFlow({
+    pkce,
+    redirectUri,
+    returnUrl,
+    state
+  }) {
     const url = new URL(returnUrl);
     const code = url.searchParams.get("code");
     if (code === null) {
       throw Error("code parameter is missing from return url.");
     }
+    if (!this.cognitoDomain) {
+      throw Error("Cognito domain is not set. Please set cognitoDomain in the CognitoClient constructor.");
+    }
     if (url.searchParams.get("state") !== state) {
       throw Error("State parameter does not match.");
     }
@@ -1447,26 +1435,31 @@ var CognitoClient = class {
     urlParams.append("grant_type", "authorization_code");
     urlParams.append("code", code);
     urlParams.append("client_id", this.userPoolClientId);
-    urlParams.append("redirect_uri", this.oAuth.redirectUrl);
+    urlParams.append("redirect_uri", redirectUri);
     urlParams.append("code_verifier", pkce);
-    const tokenEndpoint = `${this.oAuth.cognitoDomain}/oauth2/token`;
+    const tokenEndpoint = `${this.cognitoDomain}/oauth2/token`;
+    const headers = {
+      "Content-Type": "application/x-www-form-urlencoded"
+    };
+    if (this.clientSecret) {
+      const basicAuth = btoa(`${this.userPoolClientId}:${this.clientSecret}`);
+      headers["Authorization"] = `Basic ${basicAuth}`;
+    }
     const response = await fetch(tokenEndpoint, {
       method: "POST",
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded"
-      },
+      headers,
       body: urlParams.toString()
     });
     const { access_token, refresh_token, id_token, expires_in, error } = await response.json();
     if (error) {
       throw new Error(error);
     }
-    return adaptExpiresIn({
+    return {
       AccessToken: access_token,
       RefreshToken: refresh_token,
       IdToken: id_token,
       ExpiresIn: expires_in
-    });
+    };
   }
   /**
    * Invalidates the identity, access, and refresh tokens that Amazon Cognito issued to a user. Call this operation when your user signs out of your app. This results in the following behavior.
@@ -1529,7 +1522,6 @@ export {
   VerifySoftwareTokenException,
   VerifyUserAttributeError,
   VerifyUserAttributeException,
-  adaptExpiresIn,
   base64UrlToUint8Array,
   calculateHKDF,
   calculateS,
@@ -1537,6 +1529,8 @@ export {
   calculateSignature,
   calculateU,
   cognitoRequest,
+  createCredentialFromInitWebAuthResponse,
+  credentialCreateOptionsToPublicKey,
   decodeJwt,
   digest,
   formatTimestamp,

package/lib/cognito-client.d.ts

@@ -181,28 +181,6 @@ export interface ResendConfirmationCodeRequest extends CognitoBaseRequest {
     Username: string;
     SecretHash?: string;
 }
-/**
- * Cognito related OAuth props.
- */
-export interface OAuth2Props {
-    /**
-     * Cognito domain for OAuth2 token endpoints.
-     */
-    cognitoDomain: string;
-    /**
-     * Requested OAuth scopes
-     * @example ['email', 'openid']
-     */
-    scopes: string[];
-    /**
-     * Redirect URL after a successful OAuth2 authentication.
-     */
-    redirectUrl: string;
-    /**
-     * Response type.
-     */
-    responseType: 'code';
-}
 export interface CognitoClientProps {
     /**
      * Cognito User Pool ID
@@ -213,15 +191,15 @@ export interface CognitoClientProps {
      * Cognito User Pool Client ID
      */
     userPoolClientId: string;
+    /**
+     * Cognito Domain. Required for OAuth2 flows.
+     */
+    cognitoDomain?: string;
     /**
      * Optional Cognito endpoint. Useful for local testing.
      * If not defined the endpoint will be determined by @see userPoolId .
      */
     endpoint?: string;
-    /**
-     * Cognito OAuth related options. See @see OAuthProps .
-     */
-    oAuth2?: OAuth2Props;
     /**
      * Optional Cognito User Pool Client Secret.
      */
@@ -455,7 +433,7 @@ export interface StartWebAuthnRegistrationResponse {
 }
 export interface CompleteWebAuthnRegistrationRequest {
     AccessToken: string;
-    Credential: PublicKeyCredential;
+    Credential: any;
 }
 export interface DeleteWebAuthnCredentialRequest {
     AccessToken: string;
@@ -468,7 +446,7 @@ export interface ListWebAuthnCredentialsRequest {
 }
 export interface WebAuthnCredential {
     AuthenticatorTransports: string[];
-    CreatedAt: string;
+    CreatedAt: number;
     CredentialId: string;
     FriendlyCredentialName: string;
     RelyingPartyId: string;
@@ -548,24 +526,17 @@ type CognitoRequestMap = {
     [ServiceTarget.DeleteWebAuthnCredential]: DeleteWebAuthnCredentialRequest;
     [ServiceTarget.ListWebAuthnCredentials]: ListWebAuthnCredentialsRequest;
 };
-export declare function adaptExpiresIn(auth: AuthenticationResult): {
-    ExpiresIn: number;
-    AccessToken: string;
-    IdToken: string;
-    RefreshToken: string;
-    NewDeviceMetadata?: NewDeviceMetadata | undefined;
-};
 export declare function cognitoRequest<T extends ServiceTarget>(body: CognitoRequestMap[T], serviceTarget: T, cognitoEndpoint: string): Promise<CognitoResponseMap[T]>;
 /**
  * Lightweight AWS Cogito client without any AWS SDK dependencies.
  */
 export declare class CognitoClient {
     private readonly cognitoEndpoint;
+    private readonly cognitoDomain?;
     private readonly cognitoPoolName;
     private readonly userPoolClientId;
-    private readonly oAuth?;
     private readonly clientSecret?;
-    constructor({ userPoolId, userPoolClientId, endpoint, oAuth2: oAuth, clientSecret }: CognitoClientProps);
+    constructor({ userPoolId, userPoolClientId, endpoint, clientSecret, cognitoDomain }: CognitoClientProps);
     static getDecodedTokenFromSession(auth: AuthenticationResult): DecodedTokens;
     initiateAuth(request: InitiateAuthRequest): Promise<InitiateAuthResponse>;
     /**
@@ -755,7 +726,7 @@ export declare class CognitoClient {
      * Completes registration of a passkey authenticator for the currently signed-in user.
      * @param request Request to complete WebAuthn registration.
      * @param request.AccessToken Access token of the current user.
-     * @param request.Credential The credential object returned by the WebAuthn API.
+     * @param request.Credential The credential object returned by the WebAuthn API. You have to use publicKeyCredentialToJSON to convert the credential to a JSON object before sending it to Cognito.
      */
     completeWebAuthnRegistration(request: CompleteWebAuthnRegistrationRequest): Promise<void>;
     /**
@@ -785,7 +756,11 @@ export declare class CognitoClient {
      *
      * @throws {Error}
      */
-    generateOAuthSignInUrl(identityProvider?: string): Promise<{
+    generateOAuthSignInUrl({ identityProvider, redirectUri, scope }: {
+        identityProvider?: string;
+        redirectUri: string;
+        scope: string[];
+    }): Promise<{
         url: string;
         state: string;
         pkce: string;
@@ -801,7 +776,12 @@ export declare class CognitoClient {
      *
      * @throws {Error}
      */
-    handleCodeFlow(returnUrl: string, pkce: string, state: string): Promise<AuthenticationResult>;
+    handleCodeFlow({ pkce, redirectUri, returnUrl, state }: {
+        returnUrl: string;
+        redirectUri: string;
+        pkce: string;
+        state: string;
+    }): Promise<AuthenticationResult>;
     /**
      * Invalidates the identity, access, and refresh tokens that Amazon Cognito issued to a user. Call this operation when your user signs out of your app. This results in the following behavior.
      * @param accessToken Access token of the current user.

package/lib/cognito-client.js

@@ -1,5 +1,5 @@
 import { ChangePasswordError, ConfirmForgotPasswordError, ConfirmSignUpError, ForgotPasswordError, GlobalSignOutError, InitAuthError, ResendConfirmationCodeError, RespondToAuthChallengeError, RevokeTokenError, SignUpError, UpdateUserAttributesError, VerifyUserAttributeError, InitiateAuthException, COMMON_EXCEPTIONS, CommonError, VerifySoftwareTokenError, AssociateSoftwareTokenError, SetUserMFAPreferenceError, ListDevicesError, GetUserError } from './error.js';
-import { base64UrlToUint8Array, calculateSecretHash, calculateSignature, calculateU, decodeJwt, digest, generateA, generateSmallA, getPasswordAuthenticationKey, publicKeyCredentialToJSON, randomBytes, uint8ArrayFromString, uint8ArrayToBase64String } from './utils.js';
+import { calculateSecretHash, calculateSignature, calculateU, createCredentialFromInitWebAuthResponse, credentialCreateOptionsToPublicKey, decodeJwt, digest, generateA, generateSmallA, getPasswordAuthenticationKey, publicKeyCredentialToJSON, randomBytes, uint8ArrayFromString, uint8ArrayToBase64String } from './utils.js';
 /**
  * List of used and supported Cognito API calls.
  * @see https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_Operations.html for more details
@@ -37,13 +37,6 @@ export const IdentityProvider = {
     Facebook: 'Facebook',
     Apple: 'SignInWithApple'
 };
-export function adaptExpiresIn(auth) {
-    // Cognito returns expiresIn in seconds, but we want it in milliseconds from now
-    return {
-        ...auth,
-        ExpiresIn: new Date().getTime() + auth.ExpiresIn * 1000
-    };
-}
 export async function cognitoRequest(body, serviceTarget, cognitoEndpoint) {
     const cognitoResponse = await fetch(cognitoEndpoint, {
         headers: {
@@ -121,17 +114,17 @@ export async function cognitoRequest(body, serviceTarget, cognitoEndpoint) {
  */
 export class CognitoClient {
     cognitoEndpoint;
+    cognitoDomain;
     cognitoPoolName;
     userPoolClientId;
-    oAuth;
     clientSecret;
-    constructor({ userPoolId, userPoolClientId, endpoint, oAuth2: oAuth, clientSecret }) {
+    constructor({ userPoolId, userPoolClientId, endpoint, clientSecret, cognitoDomain }) {
         const [cognitoPoolRegion, cognitoPoolName] = userPoolId.split('_');
         this.cognitoEndpoint = (endpoint || `https://cognito-idp.${cognitoPoolRegion}.amazonaws.com`).replace(/\/$/, '');
         this.cognitoPoolName = cognitoPoolName;
         this.userPoolClientId = userPoolClientId;
-        this.oAuth = oAuth;
         this.clientSecret = clientSecret;
+        this.cognitoDomain = cognitoDomain;
     }
     static getDecodedTokenFromSession(auth) {
         const { payload: idToken } = decodeJwt(auth.IdToken);
@@ -142,13 +135,14 @@ export class CognitoClient {
         };
     }
     async initiateAuth(request) {
-        const cognitoResponse = await cognitoRequest({
+        const _request = {
             ...request,
             ClientId: this.userPoolClientId
-        }, ServiceTarget.InitiateAuth, this.cognitoEndpoint);
-        if (cognitoResponse.AuthenticationResult) {
-            cognitoResponse.AuthenticationResult = adaptExpiresIn(cognitoResponse.AuthenticationResult);
+        };
+        if (this.clientSecret && request.AuthParameters.USERNAME) {
+            _request.AuthParameters.SECRET_HASH = await calculateSecretHash(this.clientSecret, this.userPoolClientId, request.AuthParameters.USERNAME);
         }
+        const cognitoResponse = await cognitoRequest(_request, ServiceTarget.InitiateAuth, this.cognitoEndpoint);
         return cognitoResponse;
     }
     /**
@@ -168,8 +162,7 @@ export class CognitoClient {
             AuthFlow: 'USER_SRP_AUTH',
             AuthParameters: {
                 USERNAME: username,
-                SRP_A: A.toString(16),
-                SECRET_HASH: this.clientSecret && (await calculateSecretHash(this.clientSecret, this.userPoolClientId, username))
+                SRP_A: A.toString(16)
             },
             ClientMetadata: {}
         });
@@ -187,15 +180,10 @@ export class CognitoClient {
                 PASSWORD_CLAIM_SECRET_BLOCK: initUserSrpAuthResponse.ChallengeParameters.SECRET_BLOCK,
                 PASSWORD_CLAIM_SIGNATURE: signature,
                 USERNAME: initUserSrpAuthResponse.ChallengeParameters.USER_ID_FOR_SRP,
-                TIMESTAMP: timeStamp,
-                SECRET_HASH: this.clientSecret &&
-                    (await calculateSecretHash(this.clientSecret, this.userPoolClientId, initUserSrpAuthResponse.ChallengeParameters.USER_ID_FOR_SRP))
+                TIMESTAMP: timeStamp
             },
             ClientMetadata: {}
         });
-        if (passwordAuthChallengeResponse.AuthenticationResult) {
-            passwordAuthChallengeResponse.AuthenticationResult = adaptExpiresIn(passwordAuthChallengeResponse.AuthenticationResult);
-        }
         return passwordAuthChallengeResponse;
     }
     /**
@@ -212,8 +200,7 @@ export class CognitoClient {
             AuthFlow: 'USER_PASSWORD_AUTH',
             AuthParameters: {
                 USERNAME: username,
-                PASSWORD: password,
-                SECRET_HASH: this.clientSecret && (await calculateSecretHash(this.clientSecret, this.userPoolClientId, username))
+                PASSWORD: password
             },
             ClientMetadata: {}
         };
@@ -234,31 +221,21 @@ export class CognitoClient {
                 PREFERRED_CHALLENGE: 'WEB_AUTHN'
             }
         };
-        const authResponse = await this.initiateAuth(webAuthnPayload);
-        if (authResponse.ChallengeName !== 'WEB_AUTHN') {
-            throw new InitAuthError('Authentication failed, expected WEB_AUTHN challenge but received: ' + authResponse.ChallengeName, InitiateAuthException.InternalErrorException);
+        const initWebAuthnReponse = await this.initiateAuth(webAuthnPayload);
+        if (initWebAuthnReponse.ChallengeName !== 'WEB_AUTHN') {
+            throw new InitAuthError('Authentication failed, expected WEB_AUTHN challenge but received: ' + initWebAuthnReponse.ChallengeName, InitiateAuthException.InternalErrorException);
         }
-        const credentialRequestOptions = JSON.parse(authResponse.ChallengeParameters.CREDENTIAL_REQUEST_OPTIONS);
-        credentialRequestOptions.challenge = base64UrlToUint8Array(credentialRequestOptions.challenge);
-        credentialRequestOptions.allowCredentials = (credentialRequestOptions.allowCredentials || []).map((allowCred) => ({
-            ...allowCred,
-            id: base64UrlToUint8Array(allowCred.id)
-        }));
         const credentials = await navigator.credentials.get({
-            publicKey: credentialRequestOptions
+            publicKey: createCredentialFromInitWebAuthResponse(initWebAuthnReponse)
         });
         const challengeResponse = await this.respondToAuthChallenge({
             ChallengeName: 'WEB_AUTHN',
             ChallengeResponses: {
                 USERNAME: username,
-                CREDENTIAL: JSON.stringify(publicKeyCredentialToJSON(credentials)),
-                SECRET_HASH: this.clientSecret && (await calculateSecretHash(this.clientSecret, this.userPoolClientId, username))
+                CREDENTIAL: JSON.stringify(publicKeyCredentialToJSON(credentials))
             },
-            Session: authResponse.Session
+            Session: initWebAuthnReponse.Session
         });
-        if (challengeResponse.AuthenticationResult) {
-            challengeResponse.AuthenticationResult = adaptExpiresIn(challengeResponse.AuthenticationResult);
-        }
         return challengeResponse;
     }
     /**
@@ -274,14 +251,14 @@ export class CognitoClient {
             AccessToken: accessToken
         });
         const credentials = await navigator.credentials.create({
-            publicKey: CredentialCreationOptions
+            publicKey: credentialCreateOptionsToPublicKey(CredentialCreationOptions)
         });
         if (!(credentials instanceof PublicKeyCredential)) {
             throw new Error('Invalid credentials returned from WebAuthn API');
         }
         await this.completeWebAuthnRegistration({
             AccessToken: accessToken,
-            Credential: credentials
+            Credential: publicKeyCredentialToJSON(credentials)
         });
     }
     /**
@@ -414,7 +391,7 @@ export class CognitoClient {
      * @returns
      */
     async respondToAuthChallenge(params) {
-        if (this.clientSecret && !params.ChallengeResponses.SECRET_HASH) {
+        if (this.clientSecret) {
             params.ChallengeResponses.SECRET_HASH = await calculateSecretHash(this.clientSecret, this.userPoolClientId, params.ChallengeResponses.USERNAME);
         }
         return cognitoRequest({
@@ -541,25 +518,18 @@ export class CognitoClient {
         await cognitoRequest(resendConfirmationCodeRequest, ServiceTarget.ResendConfirmationCode, this.cognitoEndpoint);
     }
     async startWebAuthnRegistration(request) {
-        const response = await cognitoRequest(request, ServiceTarget.StartWebAuthnRegistration, this.cognitoEndpoint);
-        response.CredentialCreationOptions.challenge = base64UrlToUint8Array(response.CredentialCreationOptions.challenge);
-        response.CredentialCreationOptions.user.id = base64UrlToUint8Array(response.CredentialCreationOptions.user.id);
-        response.CredentialCreationOptions.excludeCredentials = (response.CredentialCreationOptions.excludeCredentials || []).map((excludeCred) => ({
-            ...excludeCred,
-            id: base64UrlToUint8Array(excludeCred.id)
-        }));
-        return response;
+        return cognitoRequest(request, ServiceTarget.StartWebAuthnRegistration, this.cognitoEndpoint);
     }
     /**
      * Completes registration of a passkey authenticator for the currently signed-in user.
      * @param request Request to complete WebAuthn registration.
      * @param request.AccessToken Access token of the current user.
-     * @param request.Credential The credential object returned by the WebAuthn API.
+     * @param request.Credential The credential object returned by the WebAuthn API. You have to use publicKeyCredentialToJSON to convert the credential to a JSON object before sending it to Cognito.
      */
     async completeWebAuthnRegistration(request) {
         await cognitoRequest({
             AccessToken: request.AccessToken,
-            Credential: publicKeyCredentialToJSON(request.Credential)
+            Credential: request.Credential
         }, ServiceTarget.CompleteWebAuthnRegistration, this.cognitoEndpoint);
     }
     /**
@@ -594,10 +564,7 @@ export class CognitoClient {
      *
      * @throws {Error}
      */
-    async generateOAuthSignInUrl(identityProvider) {
-        if (this.oAuth === undefined) {
-            throw Error('You have to define oAuth options to use generateFederatedSignUrl');
-        }
+    async generateOAuthSignInUrl({ identityProvider, redirectUri, scope }) {
         const state = (await randomBytes(32)).toString('hex');
         const pkce = (await randomBytes(128)).toString('hex');
         const code_challenge = uint8ArrayToBase64String(await digest('SHA-256', uint8ArrayFromString(pkce)))
@@ -605,16 +572,16 @@ export class CognitoClient {
             .replace(/\//g, '_')
             .replace(/=+$/, '');
         const queryParams = new URLSearchParams();
-        queryParams.append('redirect_uri', this.oAuth.redirectUrl);
-        queryParams.append('response_type', this.oAuth.responseType);
+        queryParams.append('redirect_uri', redirectUri);
+        queryParams.append('response_type', 'code');
         queryParams.append('client_id', this.userPoolClientId);
         identityProvider && queryParams.append('identity_provider', identityProvider);
-        queryParams.append('scope', this.oAuth.scopes.join(' '));
+        queryParams.append('scope', scope.join(' '));
         queryParams.append('state', state);
         queryParams.append('code_challenge', code_challenge);
         queryParams.append('code_challenge_method', 'S256');
         return {
-            url: `${this.oAuth.cognitoDomain}/oauth2/authorize?${queryParams.toString()}`,
+            url: `${this.cognitoDomain}/oauth2/authorize?${queryParams.toString()}`,
             state,
             pkce
         };
@@ -630,15 +597,15 @@ export class CognitoClient {
      *
      * @throws {Error}
      */
-    async handleCodeFlow(returnUrl, pkce, state) {
-        if (this.oAuth === undefined) {
-            throw Error('You have to define oAuth options to use handleCodeFlow');
-        }
+    async handleCodeFlow({ pkce, redirectUri, returnUrl, state }) {
         const url = new URL(returnUrl);
         const code = url.searchParams.get('code');
         if (code === null) {
             throw Error('code parameter is missing from return url.');
         }
+        if (!this.cognitoDomain) {
+            throw Error('Cognito domain is not set. Please set cognitoDomain in the CognitoClient constructor.');
+        }
         if (url.searchParams.get('state') !== state) {
             throw Error('State parameter does not match.');
         }
@@ -646,26 +613,31 @@ export class CognitoClient {
         urlParams.append('grant_type', 'authorization_code');
         urlParams.append('code', code);
         urlParams.append('client_id', this.userPoolClientId);
-        urlParams.append('redirect_uri', this.oAuth.redirectUrl);
+        urlParams.append('redirect_uri', redirectUri);
         urlParams.append('code_verifier', pkce);
-        const tokenEndpoint = `${this.oAuth.cognitoDomain}/oauth2/token`;
+        const tokenEndpoint = `${this.cognitoDomain}/oauth2/token`;
+        const headers = {
+            'Content-Type': 'application/x-www-form-urlencoded'
+        };
+        if (this.clientSecret) {
+            const basicAuth = btoa(`${this.userPoolClientId}:${this.clientSecret}`);
+            headers['Authorization'] = `Basic ${basicAuth}`;
+        }
         const response = await fetch(tokenEndpoint, {
             method: 'POST',
-            headers: {
-                'Content-Type': 'application/x-www-form-urlencoded'
-            },
+            headers,
             body: urlParams.toString()
         });
         const { access_token, refresh_token, id_token, expires_in, error } = await response.json();
         if (error) {
             throw new Error(error);
         }
-        return adaptExpiresIn({
+        return {
             AccessToken: access_token,
             RefreshToken: refresh_token,
             IdToken: id_token,
             ExpiresIn: expires_in
-        });
+        };
     }
     /**
      * Invalidates the identity, access, and refresh tokens that Amazon Cognito issued to a user. Call this operation when your user signs out of your app. This results in the following behavior.

package/lib/utils.d.ts

@@ -1,5 +1,6 @@
 /// <reference types="node" resolution-mode="require"/>
 /// <reference types="node" resolution-mode="require"/>
+import { InitiateAuthWebAuthResponse } from './cognito-client.js';
 export declare function uint8ArrayFromHexString(hexString: string): Uint8Array;
 export declare function uint8ArrayFromString(str: string): Uint8Array;
 export declare function uint8ArrayFromBase64String(str: string): Uint8Array;
@@ -8,6 +9,8 @@ export declare function uint8ArrayToBase64String(bytes: Uint8Array | ArrayBuffer
 export declare function uint8ArrayToBase64UrlString(bytes: Uint8Array | ArrayBuffer | undefined): string | undefined;
 export declare function base64UrlToUint8Array(base64: string): Uint8Array;
 export declare function publicKeyCredentialToJSON(cred: any): any;
+export declare function credentialCreateOptionsToPublicKey(credentialCreateOptions: any): PublicKeyCredentialCreationOptions;
+export declare function createCredentialFromInitWebAuthResponse(reposne: InitiateAuthWebAuthResponse): PublicKeyCredentialCreationOptions;
 export declare function padHex(bigInt: bigint): string;
 export declare function hashHexString(str: string): Promise<string>;
 export declare function hashBuffer(buffer: Uint8Array): Promise<string>;

package/lib/utils.js

@@ -63,6 +63,24 @@ export function publicKeyCredentialToJSON(cred) {
         type: cred.type
     });
 }
+export function credentialCreateOptionsToPublicKey(credentialCreateOptions) {
+    credentialCreateOptions.challenge = base64UrlToUint8Array(credentialCreateOptions.challenge);
+    credentialCreateOptions.user.id = base64UrlToUint8Array(credentialCreateOptions.user.id);
+    credentialCreateOptions.excludeCredentials = (credentialCreateOptions.excludeCredentials || []).map((excludeCred) => ({
+        ...excludeCred,
+        id: base64UrlToUint8Array(excludeCred.id)
+    }));
+    return credentialCreateOptions;
+}
+export function createCredentialFromInitWebAuthResponse(reposne) {
+    const credentialRequestOptions = JSON.parse(reposne.ChallengeParameters.CREDENTIAL_REQUEST_OPTIONS);
+    credentialRequestOptions.challenge = base64UrlToUint8Array(credentialRequestOptions.challenge);
+    credentialRequestOptions.allowCredentials = (credentialRequestOptions.allowCredentials || []).map((allowCred) => ({
+        ...allowCred,
+        id: base64UrlToUint8Array(allowCred.id)
+    }));
+    return credentialRequestOptions;
+}
 const N = BigInt('0xFFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD1' +
     '29024E088A67CC74020BBEA63B139B22514A08798E3404DD' +
     'EF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245' +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vardario/cognito-client",
-  "version": "5.3.0",
+  "version": "6.0.0",
   "description": "",
   "license": "MIT",
   "author": "Sahin Vardar",