captify 0.1.15

package/dist/auth/index.d.ts

@@ -0,0 +1,53 @@
+import { AccountStatus } from "./auth.constants";
+import { DefaultSession } from "next-auth";
+import { DefaultJWT } from "next-auth/jwt";
+declare module "next-auth" {
+    interface Session extends DefaultSession {
+        idToken?: string;
+        refreshToken?: string;
+        accessToken?: string;
+        user?: {
+            id: string;
+            email?: string | null;
+            groups?: string[];
+            accountStatus?: AccountStatus;
+            tenantId?: string;
+        } & DefaultSession["user"];
+    }
+    interface User {
+        id: string;
+        email?: string | null;
+        groups?: string[];
+        accountStatus?: AccountStatus;
+        tenantId?: string;
+    }
+}
+declare module "next-auth/jwt" {
+    interface JWT extends DefaultJWT {
+        idToken?: string;
+        refreshToken?: string;
+        accessToken?: string;
+        groups?: string[];
+        accountStatus?: AccountStatus;
+        tenantId?: string;
+        given_name?: string;
+        family_name?: string;
+    }
+}
+export declare const handlers: {
+    POST: (req: import("next/server").NextRequest) => Promise<Response>;
+    GET: (req: import("next/server").NextRequest) => Promise<Response>;
+};
+export declare const auth: ((args_0: import("next").NextApiRequest, args_1: import("next").NextApiResponse) => Promise<import("next-auth").Session | null>) & (() => Promise<import("next-auth").Session | null>) & ((args_0: import("next").GetServerSidePropsContext) => Promise<import("next-auth").Session | null>) & ((args_0: (req: import("next-auth").NextAuthRequest, ctx: import("next-auth/lib/types").AppRouteHandlerFnContext) => ReturnType<import("next-auth/lib/types").AppRouteHandlerFn>) => import("next-auth/lib/types").AppRouteHandlerFn) & ((args_0: import("next-auth/lib").NextAuthMiddleware) => import("next/server").NextMiddleware);
+export declare const signIn: (provider?: string, options?: Record<string, unknown>) => Promise<void>;
+export declare const signOut: <R extends boolean = true>(options?: {
+    redirectTo?: string;
+    redirect?: R;
+}) => Promise<R extends false ? any : never>;
+export * from "./auth.constants";
+export * from "./auth.schemas";
+export * from "./auth.errors";
+export * from "./auth.utilities";
+export * from "./auth.interfaces";
+export { default as AuthSessionProvider } from "./auth-session-provider";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../lib/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAwB,MAAM,2BAA2B,CAAC;AAEhF,OAAiB,EAAE,cAAc,EAAuB,MAAM,WAAW,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAG3C,OAAO,QAAQ,WAAW,CAAC;IACzB,UAAU,OAAQ,SAAQ,cAAc;QACtC,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,IAAI,CAAC,EAAE;YACL,EAAE,EAAE,MAAM,CAAC;YACX,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;YAClB,aAAa,CAAC,EAAE,aAAa,CAAC;YAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;SACnB,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;KAC5B;IAED,UAAU,IAAI;QACZ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,aAAa,CAAC,EAAE,aAAa,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB;CACF;AAED,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,GAAI,SAAQ,UAAU;QAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,aAAa,CAAC,EAAE,aAAa,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB;CACF;AAwHD,eAAO,MAAM,QAAQ;;;CAAoB,CAAC;AAC1C,eAAO,MAAM,IAAI,umBAAgB,CAAC;AAClC,eAAO,MAAM,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,IAAI,CAC1E,CAAC;AAClB,eAAO,MAAM,OAAO;cAmBuuJ,CAAC;YAA0J,CAAC;4CAnBh3J,CAAC;AAGxC,cAAc,2BAA2B,CAAC;AAG1C,cAAc,yBAAyB,CAAC;AAGxC,cAAc,wBAAwB,CAAC;AAGvC,cAAc,2BAA2B,CAAC;AAG1C,cAAc,4BAA4B,CAAC;AAG3C,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,131 @@
+import { AccountStatus, isValidAccountStatus } from "./auth.constants";
+import { refreshCognitoTokens } from "./refresh-cognito-token";
+import NextAuth from "next-auth";
+import Cognito from "next-auth/providers/cognito";
+const config = {
+    trustHost: true,
+    providers: [
+        Cognito({
+            clientId: process.env.COGNITO_CLIENT_ID,
+            clientSecret: process.env.COGNITO_CLIENT_SECRET,
+            issuer: process.env.COGNITO_ISSUER,
+            checks: ["pkce", "state", "nonce"],
+            authorization: {
+                params: {
+                    // Request additional scope for user-level Cognito API operations
+                    // aws.cognito.signin.user.admin allows users to manage their own attributes
+                    scope: "openid email profile aws.cognito.signin.user.admin",
+                },
+            },
+        }),
+    ],
+    callbacks: {
+        async jwt({ token, account, trigger }) {
+            // Handle initial sign-in
+            if (account) {
+                token.accessToken = account.access_token;
+                token.idToken = account.id_token;
+                token.refreshToken = account.refresh_token;
+                token.id = account === null || account === void 0 ? void 0 : account.providerAccountId;
+                // Extract groups, account_status, tenantId, and name fields from Cognito ID token
+                if (account.id_token) {
+                    try {
+                        const payload = JSON.parse(atob(account.id_token.split(".")[1]));
+                        token.groups = payload["cognito:groups"] || [];
+                        const rawStatus = payload["custom:account_status"];
+                        token.accountStatus = isValidAccountStatus(rawStatus)
+                            ? rawStatus
+                            : AccountStatus.UNVERIFIED;
+                        token.tenantId = payload["custom:tenant_id"];
+                        token.given_name = payload["given_name"];
+                        token.family_name = payload["family_name"];
+                        token.name = payload["name"];
+                    }
+                    catch (_a) {
+                        token.groups = [];
+                        token.accountStatus = AccountStatus.UNVERIFIED;
+                    }
+                }
+                return token;
+            }
+            // Handle manual session update (e.g., after registration submission)
+            // This forces a token refresh to get updated Cognito attributes like account_status
+            if (trigger === "update") {
+                if (token.refreshToken) {
+                    // Force refresh tokens to get updated claims from Cognito
+                    // This is necessary because attributes like account_status may have changed
+                    return await refreshCognitoTokens(token);
+                }
+                return token;
+            }
+            // Handle token expiration check on subsequent requests
+            if (token.idToken) {
+                try {
+                    const payload = JSON.parse(atob(token.idToken.split(".")[1]));
+                    const isExpired = payload.exp < Date.now() / 1000;
+                    if (!isExpired)
+                        return token;
+                    return await refreshCognitoTokens(token);
+                }
+                catch (_b) {
+                    // If token is invalid, return empty token to force re-authentication
+                    return {};
+                }
+            }
+            return token;
+        },
+        async session({ session, token }) {
+            session.idToken = token.idToken;
+            session.accessToken = token.accessToken;
+            session.refreshToken = token.refreshToken;
+            session.user.id = token.id;
+            session.user.groups = token.groups || [];
+            session.user.accountStatus = token.accountStatus || AccountStatus.UNVERIFIED;
+            session.user.tenantId = token.tenantId;
+            session.user.name = token.name;
+            // Construct full name from given_name and family_name if available
+            if (token.given_name || token.family_name) {
+                session.user.name = `${token.given_name || ""} ${token.family_name || ""}`.trim();
+            }
+            return session;
+        },
+        async redirect({ url, baseUrl }) {
+            // After successful login, check if user is approved
+            // This callback cannot access session directly during OAuth flow
+            // We rely on the proxy and layout for approval checks
+            // Allow redirect to public routes and register page
+            if (url === baseUrl || url === `${baseUrl}/` || url === `${baseUrl}/register`) {
+                return url;
+            }
+            // For all authenticated redirects, go to the requested URL
+            // The proxy will check approval and redirect unapproved users to /register
+            if (url.startsWith(baseUrl)) {
+                return url;
+            }
+            // For external URLs or unknown routes, default to landing page
+            return baseUrl;
+        },
+    },
+    pages: {
+        signIn: "/",
+        error: "/",
+    },
+};
+const nextAuth = NextAuth(config);
+export const handlers = nextAuth.handlers;
+export const auth = nextAuth.auth;
+export const signIn = nextAuth.signIn;
+export const signOut = nextAuth.signOut;
+// Re-export constants
+export * from "./auth.constants";
+// Re-export schemas
+export * from "./auth.schemas";
+// Re-export errors
+export * from "./auth.errors";
+// Re-export utilities
+export * from "./auth.utilities";
+// Re-export interfaces
+export * from "./auth.interfaces";
+// Auth Session Provider
+export { default as AuthSessionProvider } from "./auth-session-provider";
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../lib/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,QAAiD,MAAM,WAAW,CAAC;AAE1E,OAAO,OAAO,MAAM,6BAA6B,CAAC;AAsClD,MAAM,MAAM,GAAmB;IAC7B,SAAS,EAAE,IAAI;IACf,SAAS,EAAE;QACT,OAAO,CAAC;YACN,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;YACvC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB;YAC/C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;YAClC,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;YAClC,aAAa,EAAE;gBACb,MAAM,EAAE;oBACN,iEAAiE;oBACjE,4EAA4E;oBAC5E,KAAK,EAAE,oDAAoD;iBAC5D;aACF;SACF,CAAC;KACH;IACD,SAAS,EAAE;QACT,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE;YACnC,yBAAyB;YACzB,IAAI,OAAO,EAAE,CAAC;gBACZ,KAAK,CAAC,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;gBACzC,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;gBACjC,KAAK,CAAC,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC;gBAC3C,KAAK,CAAC,EAAE,GAAG,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,iBAAiB,CAAC;gBAEtC,kFAAkF;gBAClF,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;oBACrB,IAAI,CAAC;wBACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;wBACjE,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;wBAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;wBACnD,KAAK,CAAC,aAAa,GAAG,oBAAoB,CAAC,SAAS,CAAC;4BACnD,CAAC,CAAC,SAAS;4BACX,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC;wBAC7B,KAAK,CAAC,QAAQ,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;wBAC7C,KAAK,CAAC,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;wBACzC,KAAK,CAAC,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;wBAC3C,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;oBAC/B,CAAC;oBAAC,WAAM,CAAC;wBACP,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;wBAClB,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC,UAAU,CAAC;oBACjD,CAAC;gBACH,CAAC;gBAED,OAAO,KAAK,CAAC;YACf,CAAC;YAED,qEAAqE;YACrE,oFAAoF;YACpF,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACzB,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;oBACvB,0DAA0D;oBAC1D,4EAA4E;oBAC5E,OAAO,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;gBAC3C,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,uDAAuD;YACvD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAClB,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC9D,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;oBAClD,IAAI,CAAC,SAAS;wBAAE,OAAO,KAAK,CAAC;oBAC7B,OAAO,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;gBAC3C,CAAC;gBAAC,WAAM,CAAC;oBACP,qEAAqE;oBACrE,OAAO,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE;YAC9B,OAAO,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YAChC,OAAO,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;YACxC,OAAO,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,EAAY,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,aAAa,CAAC,UAAU,CAAC;YAC7E,OAAO,CAAC,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YAE/B,mEAAmE;YACnE,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC1C,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,EAAE,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;YACpF,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE;YAC7B,oDAAoD;YACpD,iEAAiE;YACjE,sDAAsD;YAEtD,oDAAoD;YACpD,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,GAAG,OAAO,GAAG,IAAI,GAAG,KAAK,GAAG,OAAO,WAAW,EAAE,CAAC;gBAC9E,OAAO,GAAG,CAAC;YACb,CAAC;YAED,2DAA2D;YAC3D,2EAA2E;YAC3E,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,OAAO,GAAG,CAAC;YACb,CAAC;YAED,+DAA+D;YAC/D,OAAO,OAAO,CAAC;QACjB,CAAC;KACF;IACD,KAAK,EAAE;QACL,MAAM,EAAE,GAAG;QACX,KAAK,EAAE,GAAG;KACX;CACF,CAAC;AAEF,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;AAElC,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;AAC1C,MAAM,CAAC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;AAClC,MAAM,CAAC,MAAM,MAAM,GACjB,QAAQ,CAAC,MAAM,CAAC;AAClB,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;AAExC,sBAAsB;AACtB,cAAc,2BAA2B,CAAC;AAE1C,oBAAoB;AACpB,cAAc,yBAAyB,CAAC;AAExC,mBAAmB;AACnB,cAAc,wBAAwB,CAAC;AAEvC,sBAAsB;AACtB,cAAc,2BAA2B,CAAC;AAE1C,uBAAuB;AACvB,cAAc,4BAA4B,CAAC;AAE3C,wBAAwB;AACxB,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/auth/interfaces.d.ts

@@ -0,0 +1,207 @@
+/**
+ * Interfaces for Auth module
+ * Includes Cognito and Registration interfaces
+ */
+import type { Logger } from "../services/logger";
+import type { UserAwsCredentials } from "../services/shared";
+import type { CognitoIdentityProviderClient, UserStatusType } from "@aws-sdk/client-cognito-identity-provider";
+export { AccountStatus } from "./";
+import type { AccountStatus } from "./";
+/**
+ * Configuration for user-level Cognito operations
+ * Only requires region since user-level APIs use access tokens
+ */
+export interface CognitoUserConfig {
+    region: string;
+}
+export interface CognitoConfig {
+    region: string;
+    clientId: string;
+    clientSecret?: string;
+    userPoolId: string;
+    /**
+     * Identity Pool ID for user-level AWS access control
+     * Required for governance compliance - enables IAM-based permissions per user
+     */
+    identityPoolId?: string;
+    /**
+     * Admin credentials for backend service operations
+     * Use when performing admin operations that don't require user-level access control
+     */
+    credentials?: {
+        accessKeyId: string;
+        secretAccessKey: string;
+        /** Session token for temporary credentials (from AWS STS/SSO) */
+        sessionToken?: string;
+    };
+}
+/**
+ * User context for audit logging
+ * Pass this to track which user initiated the operation
+ */
+export interface UserContext {
+    /** User ID from JWT token (sub claim) */
+    userId: string;
+    /** Username from JWT token (cognito:username claim) */
+    username?: string;
+    /** User's email (optional) */
+    email?: string;
+    /** User's IP address (optional) */
+    ipAddress?: string;
+    /** User agent / device info (optional) */
+    userAgent?: string;
+    /** Request ID for tracing (optional) */
+    requestId?: string;
+    /** Any additional metadata */
+    metadata?: Record<string, string>;
+}
+/**
+ * Parameters for getting user AWS credentials from Identity Pool
+ */
+export interface GetUserCredentialsParams {
+    /** JWT ID token from Cognito User Pool authentication */
+    idToken: string;
+    /** User Pool ID (optional, uses config default if not provided) */
+    userPoolId?: string;
+}
+export type { UserAwsCredentials };
+/**
+ * Cache entry for user credentials with LRU metadata
+ */
+export interface CredentialsCacheEntry {
+    credentials: UserAwsCredentials;
+    cachedAt: Date;
+    /** Last access timestamp for LRU eviction */
+    lastAccessedAt: Date;
+}
+export interface CognitoAdminServiceDeps {
+    logger?: Logger;
+    config: CognitoConfig;
+    client?: CognitoIdentityProviderClient;
+}
+export interface CognitoAdminCreateUserParams {
+    username: string;
+    password?: string;
+    email?: string;
+    phoneNumber?: string;
+    attributes?: Record<string, string>;
+    temporaryPassword?: boolean;
+    messageAction?: "RESEND" | "SUPPRESS";
+}
+export interface CognitoAdminUpdateUserParams {
+    username: string;
+    attributes?: Record<string, string>;
+    enabled?: boolean;
+}
+export interface CognitoAdminDeleteUserParams {
+    username: string;
+}
+export interface CognitoAdminListUsersParams {
+    limit?: number;
+    paginationToken?: string;
+    filter?: string;
+}
+export interface CognitoAdminCreateGroupParams {
+    groupName: string;
+    description?: string;
+    precedence?: number;
+    roleArn?: string;
+}
+export interface CognitoAdminAddUserToGroupParams {
+    username: string;
+    groupName: string;
+}
+export interface CognitoAdminRemoveUserFromGroupParams {
+    username: string;
+    groupName: string;
+}
+export interface CognitoAdminListGroupsForUserParams {
+    username: string;
+    limit?: number;
+    nextToken?: string;
+}
+export interface CognitoAdminListGroupsParams {
+    limit?: number;
+    nextToken?: string;
+}
+export interface CognitoAdminGetGroupParams {
+    groupName: string;
+}
+export interface CognitoAdminUpdateGroupParams {
+    groupName: string;
+    description?: string;
+    precedence?: number;
+    roleArn?: string;
+}
+export interface CognitoAdminDeleteGroupParams {
+    groupName: string;
+}
+export interface CognitoAdminListUsersInGroupParams {
+    groupName: string;
+    limit?: number;
+    nextToken?: string;
+}
+export interface CognitoAdminListPendingUsersParams {
+    limit?: number;
+    paginationToken?: string;
+}
+export interface CognitoAdminApproveUserParams {
+    username: string;
+}
+export interface CognitoAdminRejectUserParams {
+    username: string;
+}
+export interface CognitoAdminUser {
+    username: string;
+    email?: string;
+    phoneNumber?: string;
+    enabled: boolean;
+    userStatus: UserStatusType;
+    attributes?: Record<string, string>;
+    createdAt?: Date;
+    updatedAt?: Date;
+    lastModifiedDate?: Date;
+    lastLoginDate?: Date;
+}
+export interface CognitoAdminGroup {
+    groupName: string;
+    description?: string;
+    precedence?: number;
+    roleArn?: string;
+    creationDate?: Date;
+    lastModifiedDate?: Date;
+}
+/**
+ * Cognito user details returned by user-level APIs
+ * Simplified version without admin-specific fields
+ */
+export interface CognitoUser {
+    /** User's Cognito username (sub) */
+    username: string;
+    /** User's email address */
+    email?: string;
+    /** User's phone number */
+    phoneNumber?: string;
+    /** All user attributes (standard + custom) */
+    attributes?: Record<string, string>;
+}
+import type { CognitoUserService } from "./services/cognito-user.service";
+/**
+ * Registration service dependencies
+ */
+export interface RegistrationServiceDeps {
+    logger?: Logger;
+    cognitoUserService: CognitoUserService;
+}
+/**
+ * Result of approval status check
+ */
+export interface ApprovalStatusResult {
+    /** Whether the user is approved (account_status = verified) */
+    isApproved: boolean;
+    /** Current account status */
+    accountStatus: AccountStatus;
+    /** User's email address */
+    userEmail?: string;
+}
+//# sourceMappingURL=interfaces.d.ts.map

package/dist/auth/interfaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../lib/auth/interfaces.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EACV,6BAA6B,EAC7B,cAAc,EACf,MAAM,2CAA2C,CAAC;AAGnD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAMhD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,WAAW,CAAC,EAAE;QACZ,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;QACxB,iEAAiE;QACjE,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAGD,YAAY,EAAE,kBAAkB,EAAE,CAAC;AAEnC;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,kBAAkB,CAAC;IAChC,QAAQ,EAAE,IAAI,CAAC;IACf,6CAA6C;IAC7C,cAAc,EAAE,IAAI,CAAC;CACtB;AAMD,MAAM,WAAW,uBAAuB;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,6BAA6B,CAAC;CACxC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,aAAa,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;CACvC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qCAAqC;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kCAAkC;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kCAAkC;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,cAAc,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,gBAAgB,CAAC,EAAE,IAAI,CAAC;IACxB,aAAa,CAAC,EAAE,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,IAAI,CAAC;IACpB,gBAAgB,CAAC,EAAE,IAAI,CAAC;CACzB;AAMD;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,2BAA2B;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0BAA0B;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAOD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAEnF;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kBAAkB,EAAE,kBAAkB,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,+DAA+D;IAC/D,UAAU,EAAE,OAAO,CAAC;IACpB,6BAA6B;IAC7B,aAAa,EAAE,aAAa,CAAC;IAC7B,2BAA2B;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB"}

package/dist/auth/interfaces.js

@@ -0,0 +1,7 @@
+/**
+ * Interfaces for Auth module
+ * Includes Cognito and Registration interfaces
+ */
+// Re-export AccountStatus enum from index for convenience
+export { AccountStatus } from "./";
+//# sourceMappingURL=interfaces.js.map

package/dist/auth/interfaces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../lib/auth/interfaces.ts"],"names":[],"mappings":"AAAA;;;GAGG;AASH,0DAA0D;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}

package/dist/auth/refresh-cognito-token.d.ts

@@ -0,0 +1,10 @@
+import { JWT } from "next-auth/jwt";
+/**
+ * Refresh Cognito tokens using the refresh token
+ * Also parses the new ID token to extract updated claims (accountStatus, groups, etc.)
+ *
+ * @param token - The current JWT token containing the refresh token
+ * @returns Updated token with new access/id tokens and parsed claims
+ */
+export declare function refreshCognitoTokens(token: JWT): Promise<JWT>;
+//# sourceMappingURL=refresh-cognito-token.d.ts.map

package/dist/auth/refresh-cognito-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-cognito-token.d.ts","sourceRoot":"","sources":["../../lib/auth/refresh-cognito-token.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AA8CpC;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAsCnE"}

package/dist/auth/refresh-cognito-token.js

@@ -0,0 +1,66 @@
+"use server";
+import { AccountStatus, isValidAccountStatus } from "./auth.constants";
+const basicAuth = Buffer.from(`${process.env.COGNITO_CLIENT_ID}:${process.env.COGNITO_CLIENT_SECRET}`).toString("base64");
+/**
+ * Parse claims from a Cognito ID token
+ * Extracts groups, account_status, tenant_id, and name fields
+ *
+ * @param idToken - The JWT ID token string
+ * @returns Parsed claims or default values if parsing fails
+ */
+function parseIdTokenClaims(idToken) {
+    try {
+        const payload = JSON.parse(atob(idToken.split(".")[1]));
+        const rawStatus = payload["custom:account_status"];
+        return {
+            groups: payload["cognito:groups"] || [],
+            accountStatus: isValidAccountStatus(rawStatus) ? rawStatus : AccountStatus.UNVERIFIED,
+            tenantId: payload["custom:tenant_id"],
+            givenName: payload["given_name"],
+            familyName: payload["family_name"],
+            name: payload["name"],
+        };
+    }
+    catch (_a) {
+        return {
+            groups: [],
+            accountStatus: AccountStatus.UNVERIFIED,
+        };
+    }
+}
+/**
+ * Refresh Cognito tokens using the refresh token
+ * Also parses the new ID token to extract updated claims (accountStatus, groups, etc.)
+ *
+ * @param token - The current JWT token containing the refresh token
+ * @returns Updated token with new access/id tokens and parsed claims
+ */
+export async function refreshCognitoTokens(token) {
+    var _a;
+    try {
+        const response = await fetch(`${process.env.COGNITO_DOMAIN}/oauth2/token`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/x-www-form-urlencoded",
+                Authorization: `Basic ${basicAuth}`,
+            },
+            body: new URLSearchParams({
+                grant_type: "refresh_token",
+                refresh_token: token.refreshToken,
+            }),
+        });
+        const refreshedTokens = await response.json();
+        if (!response.ok)
+            throw refreshedTokens;
+        const newIdToken = refreshedTokens.id_token;
+        // Parse claims from the refreshed ID token
+        const claims = parseIdTokenClaims(newIdToken);
+        return Object.assign(Object.assign({}, token), { accessToken: refreshedTokens.access_token, idToken: newIdToken, refreshToken: (_a = refreshedTokens.refresh_token) !== null && _a !== void 0 ? _a : token.refreshToken, 
+            // Update token with parsed claims from refreshed ID token
+            groups: claims.groups, accountStatus: claims.accountStatus, tenantId: claims.tenantId, given_name: claims.givenName, family_name: claims.familyName, name: claims.name });
+    }
+    catch (error) {
+        return Object.assign(Object.assign({}, token), { error: "RefreshAccessTokenError", errorMessage: error });
+    }
+}
+//# sourceMappingURL=refresh-cognito-token.js.map

package/dist/auth/refresh-cognito-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-cognito-token.js","sourceRoot":"","sources":["../../lib/auth/refresh-cognito-token.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAGhF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAC3B,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,CACxE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAcrB;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,OAAe;IACzC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;QAEnD,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE;YACvC,aAAa,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU;YACrF,QAAQ,EAAE,OAAO,CAAC,kBAAkB,CAAC;YACrC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC;YAChC,UAAU,EAAE,OAAO,CAAC,aAAa,CAAC;YAClC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC;SACtB,CAAC;IACJ,CAAC;IAAC,WAAM,CAAC;QACP,OAAO;YACL,MAAM,EAAE,EAAE;YACV,aAAa,EAAE,aAAa,CAAC,UAAU;SACxC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAU;;IACnD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,eAAe,EAAE;YACzE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,aAAa,EAAE,SAAS,SAAS,EAAE;aACpC;YACD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,KAAK,CAAC,YAAa;aACnC,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,eAAe,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,eAAe,CAAC;QAExC,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,CAAC;QAE5C,2CAA2C;QAC3C,MAAM,MAAM,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAE9C,uCACK,KAAK,KACR,WAAW,EAAE,eAAe,CAAC,YAAY,EACzC,OAAO,EAAE,UAAU,EACnB,YAAY,EAAE,MAAA,eAAe,CAAC,aAAa,mCAAI,KAAK,CAAC,YAAY;YACjE,0DAA0D;YAC1D,MAAM,EAAE,MAAM,CAAC,MAAM,EACrB,aAAa,EAAE,MAAM,CAAC,aAAa,EACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,UAAU,EAAE,MAAM,CAAC,SAAS,EAC5B,WAAW,EAAE,MAAM,CAAC,UAAU,EAC9B,IAAI,EAAE,MAAM,CAAC,IAAI,IACjB;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,uCAAY,KAAK,KAAE,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,KAAK,IAAG;IAC7E,CAAC;AACH,CAAC"}