quidproquo-actionprocessor-awslambda 0.0.263 → 0.1.1

package/lib/esm/getActionProcessor/core/userDirectory/getUserDirectoryGetUserAttributesByUserIdActionProcessor.js

@@ -1,5 +1,5 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
-import { actionResult, UserDirectoryActionType, } from 'quidproquo-core';
+import { actionResult, actionResultError, actionResultErrorFromCaughtError, UserDirectoryActionType, UserDirectoryGetUserAttributesByUserIdErrorTypeEnum, } from 'quidproquo-core';
 import { getCFExportNameUserPoolIdFromConfig } from '../../../awsNamingUtils';
 import { getExportedValue } from '../../../logic/cloudformation/getExportedValue';
 import { getUserAttributesBySub } from '../../../logic/cognito/getUserAttributesBySub';
@@ -7,8 +7,15 @@ const getProcessGetUserAttributesByUserId = (qpqConfig) => {
     return async ({ userDirectoryName, userId }, session) => {
         const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
         const userPoolId = await getExportedValue(getCFExportNameUserPoolIdFromConfig(userDirectoryName, qpqConfig), region);
-        const userAttributes = await getUserAttributesBySub(userPoolId, region, userId);
-        return actionResult(userAttributes);
+        try {
+            const userAttributes = await getUserAttributesBySub(userPoolId, region, userId);
+            return actionResult(userAttributes);
+        }
+        catch (error) {
+            return actionResultErrorFromCaughtError(error, {
+                USER_NOT_FOUND: () => actionResultError(UserDirectoryGetUserAttributesByUserIdErrorTypeEnum.UserNotFound, 'No user found for this userId'),
+            });
+        }
     };
 };
 export const getUserDirectoryGetUserAttributesByUserIdActionProcessor = async (qpqConfig) => ({

package/lib/esm/getActionProcessor/core/userDirectory/getUserDirectoryGetUsersActionProcessor.js

@@ -1,5 +1,5 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
-import { actionResult, UserDirectoryActionType, } from 'quidproquo-core';
+import { actionResult, actionResultError, actionResultErrorFromCaughtError, UserDirectoryActionType, UserDirectoryGetUsersErrorTypeEnum, } from 'quidproquo-core';
 import { getCFExportNameUserPoolIdFromConfig } from '../../../awsNamingUtils';
 import { getExportedValue } from '../../../logic/cloudformation/getExportedValue';
 import { listPagedUsers } from '../../../logic/cognito/listPagedUsers';
@@ -7,8 +7,16 @@ const getProcessGetUsers = (qpqConfig) => {
     return async ({ userDirectoryName, nextPageKey }, session) => {
         const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
         const userPoolId = await getExportedValue(getCFExportNameUserPoolIdFromConfig(userDirectoryName, qpqConfig), region);
-        const userAttributes = await listPagedUsers(userPoolId, region, nextPageKey);
-        return actionResult(userAttributes);
+        try {
+            const userAttributes = await listPagedUsers(userPoolId, region, nextPageKey);
+            return actionResult(userAttributes);
+        }
+        catch (error) {
+            return actionResultErrorFromCaughtError(error, {
+                InvalidParameterException: () => actionResultError(UserDirectoryGetUsersErrorTypeEnum.InvalidPageKey, 'The supplied page key is invalid'),
+                TooManyRequestsException: () => actionResultError(UserDirectoryGetUsersErrorTypeEnum.LimitExceeded, 'Too many requests, please try again later'),
+            });
+        }
     };
 };
 export const getUserDirectoryGetUsersActionProcessor = async (qpqConfig) => ({

package/lib/esm/getActionProcessor/core/userDirectory/getUserDirectoryGetUsersByAttributeActionProcessor.js

@@ -1,5 +1,5 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
-import { actionResult, UserDirectoryActionType, } from 'quidproquo-core';
+import { actionResult, actionResultError, actionResultErrorFromCaughtError, UserDirectoryActionType, UserDirectoryGetUsersByAttributeErrorTypeEnum, } from 'quidproquo-core';
 import { getCFExportNameUserPoolIdFromConfig } from '../../../awsNamingUtils';
 import { getExportedValue } from '../../../logic/cloudformation/getExportedValue';
 import { listPagedUsersByAttribute } from '../../../logic/cognito/listPagedUsersByAttribute';
@@ -7,8 +7,16 @@ const getProcessGetUsersByAttribute = (qpqConfig) => {
     return async ({ userDirectoryName, attribueName, attribueValue, limit, nextPageKey }, _session) => {
         const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
         const userPoolId = await getExportedValue(getCFExportNameUserPoolIdFromConfig(userDirectoryName, qpqConfig), region);
-        const userAttributes = await listPagedUsersByAttribute(userPoolId, region, attribueName, attribueValue, limit, nextPageKey);
-        return actionResult(userAttributes);
+        try {
+            const userAttributes = await listPagedUsersByAttribute(userPoolId, region, attribueName, attribueValue, limit, nextPageKey);
+            return actionResult(userAttributes);
+        }
+        catch (error) {
+            return actionResultErrorFromCaughtError(error, {
+                InvalidParameterException: () => actionResultError(UserDirectoryGetUsersByAttributeErrorTypeEnum.InvalidSearchParameters, 'The search attribute, value, limit, or page key is invalid'),
+                TooManyRequestsException: () => actionResultError(UserDirectoryGetUsersByAttributeErrorTypeEnum.LimitExceeded, 'Too many requests, please try again later'),
+            });
+        }
     };
 };
 export const getUserDirectoryGetUsersByAttributeActionProcessor = async (qpqConfig) => ({

package/lib/esm/getActionProcessor/core/userDirectory/getUserDirectoryRefreshTokenActionProcessor.js

@@ -1,5 +1,5 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
-import { actionResult, actionResultError, ErrorTypeEnum, UserDirectoryActionType, } from 'quidproquo-core';
+import { actionResult, actionResultError, actionResultErrorFromCaughtError, UserDirectoryActionType, UserDirectoryRefreshTokenErrorTypeEnum, } from 'quidproquo-core';
 import { getCFExportNameUserPoolClientIdFromConfig, getCFExportNameUserPoolIdFromConfig } from '../../../awsNamingUtils';
 import { getExportedValue } from '../../../logic/cloudformation/getExportedValue';
 import { refreshToken as cognitoRefreshToken } from '../../../logic/cognito/refreshToken';
@@ -9,10 +9,24 @@ const getProcessRefreshToken = (qpqConfig) => {
         const userPoolId = await getExportedValue(getCFExportNameUserPoolIdFromConfig(userDirectoryName, qpqConfig), region);
         const userPoolClientId = await getExportedValue(getCFExportNameUserPoolClientIdFromConfig(userDirectoryName, qpqConfig), region);
         if (!session.decodedAccessToken || !session.decodedAccessToken.username) {
-            return actionResultError(ErrorTypeEnum.Unauthorized, 'Invalid accessToken');
+            return actionResultError(UserDirectoryRefreshTokenErrorTypeEnum.Unauthorized, 'Invalid accessToken');
+        }
+        // NOTE: we intentionally do NOT gate on decodedAccessToken.wasValid here.
+        // Refresh must accept a signature-valid-but-expired access token (that's the
+        // point of refreshing), and wasValid folds in the expiry check. The trust
+        // anchor for this operation is the refreshToken itself: Cognito's
+        // REFRESH_TOKEN_AUTH validates it and the SECRET_HASH binds it to `username`,
+        // so a forged/unverified username cannot mint tokens for another user.
+        try {
+            const authResponse = await cognitoRefreshToken(userPoolId, userPoolClientId, qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig), session.decodedAccessToken.username, refreshToken);
+            return actionResult(authResponse);
+        }
+        catch (error) {
+            return actionResultErrorFromCaughtError(error, {
+                NotAuthorizedException: () => actionResultError(UserDirectoryRefreshTokenErrorTypeEnum.Unauthorized, 'Refresh token is invalid or has expired'),
+                TooManyRequestsException: () => actionResultError(UserDirectoryRefreshTokenErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+            });
         }
-        const authResponse = await cognitoRefreshToken(userPoolId, userPoolClientId, qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig), session.decodedAccessToken.username, refreshToken);
-        return actionResult(authResponse);
     };
 };
 export const getUserDirectoryRefreshTokenActionProcessor = async (qpqConfig) => ({

package/lib/esm/getActionProcessor/core/userDirectory/getUserDirectoryRequestEmailVerificationActionProcessor.js

@@ -1,11 +1,20 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
-import { actionResult, UserDirectoryActionType, } from 'quidproquo-core';
+import { actionResult, actionResultError, actionResultErrorFromCaughtError, UserDirectoryActionType, UserDirectoryRequestEmailVerificationErrorTypeEnum, } from 'quidproquo-core';
 import { requestEmailVerificationCode } from '../../../logic/cognito/requestEmailVerificationCode';
 const getProcessRequestEmailVerification = (qpqConfig) => {
     return async ({ userDirectoryName, accessToken }) => {
         const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
-        await requestEmailVerificationCode(region, accessToken);
-        return actionResult(void 0);
+        try {
+            await requestEmailVerificationCode(region, accessToken);
+            return actionResult(void 0);
+        }
+        catch (error) {
+            return actionResultErrorFromCaughtError(error, {
+                NotAuthorizedException: () => actionResultError(UserDirectoryRequestEmailVerificationErrorTypeEnum.Unauthorized, 'Access token is invalid or has expired'),
+                LimitExceededException: () => actionResultError(UserDirectoryRequestEmailVerificationErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+                CodeDeliveryFailureException: () => actionResultError(UserDirectoryRequestEmailVerificationErrorTypeEnum.CodeDeliveryFailed, 'Could not deliver the verification code'),
+            });
+        }
     };
 };
 export const getUserDirectoryRequestEmailVerificationActionProcessor = async (qpqConfig) => ({

package/lib/esm/getActionProcessor/core/userDirectory/getUserDirectoryRespondToAuthChallengeActionProcessor.js

@@ -1,9 +1,10 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
-import { actionResult, AuthenticateUserChallenge, UserDirectoryActionType, } from 'quidproquo-core';
+import { actionResult, actionResultError, actionResultErrorFromCaughtError, AuthenticateUserChallenge, UserDirectoryActionType, UserDirectoryRespondToAuthChallengeErrorTypeEnum, } from 'quidproquo-core';
 import { ChallengeNameType } from '@aws-sdk/client-cognito-identity-provider';
 import { getCFExportNameUserPoolClientIdFromConfig, getCFExportNameUserPoolIdFromConfig } from '../../../awsNamingUtils';
 import { getExportedValue } from '../../../logic/cloudformation/getExportedValue';
 import { respondToAuthChallengeChallenge } from '../../../logic/cognito/respondToAuthChallengeChallenge';
+import { verifySoftwareToken } from '../../../logic/cognito/verifySoftwareToken';
 const anyAuthChallengeToCognitoAttributes = (authChallenge) => {
     switch (authChallenge.challenge) {
         case AuthenticateUserChallenge.NEW_PASSWORD_REQUIRED:
@@ -14,6 +15,14 @@ const anyAuthChallengeToCognitoAttributes = (authChallenge) => {
             return {
                 ANSWER: JSON.stringify(authChallenge.challengeAnswer),
             };
+        case AuthenticateUserChallenge.SOFTWARE_TOKEN_MFA:
+            return {
+                SOFTWARE_TOKEN_MFA_CODE: authChallenge.mfaCode,
+            };
+        // MFA_SETUP completes with just USERNAME/SESSION — the TOTP code is consumed
+        // by the preceding VerifySoftwareToken call, not by RespondToAuthChallenge.
+        case AuthenticateUserChallenge.MFA_SETUP:
+            return {};
         default:
             return {};
     }
@@ -24,6 +33,10 @@ const anyAuthChallengeToCognitoChallengeName = (authChallenge) => {
             return ChallengeNameType.NEW_PASSWORD_REQUIRED;
         case AuthenticateUserChallenge.CUSTOM_CHALLENGE:
             return ChallengeNameType.CUSTOM_CHALLENGE;
+        case AuthenticateUserChallenge.SOFTWARE_TOKEN_MFA:
+            return ChallengeNameType.SOFTWARE_TOKEN_MFA;
+        case AuthenticateUserChallenge.MFA_SETUP:
+            return ChallengeNameType.MFA_SETUP;
         default:
             throw new Error(`Unknown challenge`);
     }
@@ -33,8 +46,27 @@ const getProcessRespondToAuthChallenge = (qpqConfig) => {
         const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
         const userPoolId = await getExportedValue(getCFExportNameUserPoolIdFromConfig(userDirectoryName, qpqConfig), region);
         const userPoolClientId = await getExportedValue(getCFExportNameUserPoolClientIdFromConfig(userDirectoryName, qpqConfig), region);
-        const response = await respondToAuthChallengeChallenge(userPoolId, userPoolClientId, region, authChallenge.username, authChallenge.session, anyAuthChallengeToCognitoChallengeName(authChallenge), anyAuthChallengeToCognitoAttributes(authChallenge));
-        return actionResult(response);
+        // MFA_SETUP must verify the TOTP code first; Cognito returns a fresh session
+        // that is then used to complete the challenge and issue tokens.
+        let session = authChallenge.session;
+        try {
+            if (authChallenge.challenge === AuthenticateUserChallenge.MFA_SETUP) {
+                session = await verifySoftwareToken(region, session, authChallenge.mfaCode);
+            }
+            const response = await respondToAuthChallengeChallenge(userPoolId, userPoolClientId, region, authChallenge.username, session, anyAuthChallengeToCognitoChallengeName(authChallenge), anyAuthChallengeToCognitoAttributes(authChallenge));
+            return actionResult(response);
+        }
+        catch (error) {
+            return actionResultErrorFromCaughtError(error, {
+                CodeMismatchException: () => actionResultError(UserDirectoryRespondToAuthChallengeErrorTypeEnum.InvalidCode, 'The supplied code is incorrect'),
+                EnableSoftwareTokenMFAException: () => actionResultError(UserDirectoryRespondToAuthChallengeErrorTypeEnum.InvalidCode, 'The supplied code is incorrect'),
+                ExpiredCodeException: () => actionResultError(UserDirectoryRespondToAuthChallengeErrorTypeEnum.ExpiredCode, 'The supplied code has expired'),
+                InvalidPasswordException: () => actionResultError(UserDirectoryRespondToAuthChallengeErrorTypeEnum.InvalidNewPassword, 'New password does not meet the password policy'),
+                NotAuthorizedException: () => actionResultError(UserDirectoryRespondToAuthChallengeErrorTypeEnum.Unauthorized, 'The challenge session is invalid or has expired'),
+                LimitExceededException: () => actionResultError(UserDirectoryRespondToAuthChallengeErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+                TooManyRequestsException: () => actionResultError(UserDirectoryRespondToAuthChallengeErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+            });
+        }
     };
 };
 export const getUserDirectoryRespondToAuthChallengeActionProcessor = async (qpqConfig) => ({

package/lib/esm/getActionProcessor/core/userDirectory/getUserDirectorySetPasswordActionProcessor.js

@@ -1,5 +1,5 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
-import { actionResult, UserDirectoryActionType, } from 'quidproquo-core';
+import { actionResult, actionResultError, actionResultErrorFromCaughtError, UserDirectoryActionType, UserDirectorySetPasswordErrorTypeEnum, } from 'quidproquo-core';
 import { getCFExportNameUserPoolIdFromConfig } from '../../../awsNamingUtils';
 import { getExportedValue } from '../../../logic/cloudformation/getExportedValue';
 import { resolveUsernameByPreferredUsername } from '../../../logic/cognito/resolveUsernameByPreferredUsername';
@@ -9,8 +9,18 @@ const getProcessSetPassword = (qpqConfig) => {
         const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
         const userPoolId = await getExportedValue(getCFExportNameUserPoolIdFromConfig(userDirectoryName, qpqConfig), region);
         const resolvedUsername = await resolveUsernameByPreferredUsername(userPoolId, region, username);
-        await setUserPassword(region, userPoolId, resolvedUsername, newPassword);
-        return actionResult(void 0);
+        try {
+            await setUserPassword(region, userPoolId, resolvedUsername, newPassword);
+            return actionResult(void 0);
+        }
+        catch (error) {
+            return actionResultErrorFromCaughtError(error, {
+                UserNotFoundException: () => actionResultError(UserDirectorySetPasswordErrorTypeEnum.UserNotFound, 'No account found for this user'),
+                InvalidPasswordException: () => actionResultError(UserDirectorySetPasswordErrorTypeEnum.InvalidNewPassword, 'Password does not meet the password policy'),
+                LimitExceededException: () => actionResultError(UserDirectorySetPasswordErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+                TooManyRequestsException: () => actionResultError(UserDirectorySetPasswordErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+            });
+        }
     };
 };
 export const getUserDirectorySetPasswordActionProcessor = async (qpqConfig) => ({

package/lib/esm/getActionProcessor/core/userDirectory/getUserDirectorySetUserAttributesActionProcessor.js

@@ -1,5 +1,5 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
-import { actionResult, UserDirectoryActionType, } from 'quidproquo-core';
+import { actionResult, actionResultError, actionResultErrorFromCaughtError, UserDirectoryActionType, UserDirectorySetUserAttributesErrorTypeEnum, } from 'quidproquo-core';
 import { getCFExportNameUserPoolIdFromConfig } from '../../../awsNamingUtils';
 import { getExportedValue } from '../../../logic/cloudformation/getExportedValue';
 import { resolveUsernameByPreferredUsername } from '../../../logic/cognito/resolveUsernameByPreferredUsername';
@@ -9,8 +9,19 @@ const getProcessSetUserAttributes = (qpqConfig) => {
         const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
         const userPoolId = await getExportedValue(getCFExportNameUserPoolIdFromConfig(userDirectoryName, qpqConfig), region);
         const resolvedUsername = await resolveUsernameByPreferredUsername(userPoolId, region, username);
-        await setUserAttributes(userPoolId, region, resolvedUsername, userAttributes);
-        return actionResult(void 0);
+        try {
+            await setUserAttributes(userPoolId, region, resolvedUsername, userAttributes);
+            return actionResult(void 0);
+        }
+        catch (error) {
+            return actionResultErrorFromCaughtError(error, {
+                UserNotFoundException: () => actionResultError(UserDirectorySetUserAttributesErrorTypeEnum.UserNotFound, 'No account found for this user'),
+                InvalidParameterException: () => actionResultError(UserDirectorySetUserAttributesErrorTypeEnum.InvalidAttributes, 'One or more attributes are invalid'),
+                AliasExistsException: () => actionResultError(UserDirectorySetUserAttributesErrorTypeEnum.AliasExists, 'That email or phone number is already in use'),
+                LimitExceededException: () => actionResultError(UserDirectorySetUserAttributesErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+                TooManyRequestsException: () => actionResultError(UserDirectorySetUserAttributesErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+            });
+        }
     };
 };
 export const getUserDirectorySetUserAttributesActionProcessor = async (qpqConfig) => ({

package/lib/esm/getActionProcessor/core/userDirectory/index.js

@@ -1,3 +1,4 @@
+import { getUserDirectoryAssociateSoftwareTokenActionProcessor } from './getUserDirectoryAssociateSoftwareTokenActionProcessor';
 import { getUserDirectoryAuthenticateUserActionProcessor } from './getUserDirectoryAuthenticateUserActionProcessor';
 import { getUserDirectoryChangePasswordActionProcessor } from './getUserDirectoryChangePasswordActionProcessor';
 import { getUserDirectoryConfirmEmailVerificationActionProcessor } from './getUserDirectoryConfirmEmailVerificationActionProcessor';
@@ -17,6 +18,7 @@ import { getUserDirectorySetAccessTokenActionProcessor } from './getUserDirector
 import { getUserDirectorySetPasswordActionProcessor } from './getUserDirectorySetPasswordActionProcessor';
 import { getUserDirectorySetUserAttributesActionProcessor } from './getUserDirectorySetUserAttributesActionProcessor';
 export const getUserDirectoryActionProcessor = async (qpqConfig, dynamicModuleLoader) => ({
+    ...(await getUserDirectoryAssociateSoftwareTokenActionProcessor(qpqConfig, dynamicModuleLoader)),
     ...(await getUserDirectoryAuthenticateUserActionProcessor(qpqConfig, dynamicModuleLoader)),
     ...(await getUserDirectoryChangePasswordActionProcessor(qpqConfig, dynamicModuleLoader)),
     ...(await getUserDirectoryConfirmEmailVerificationActionProcessor(qpqConfig, dynamicModuleLoader)),

package/lib/esm/getActionProcessor/webserver/index.d.ts

@@ -1,4 +1,3 @@
-export * from './extract';
 export * from './serviceFunction';
 export * from './webEntry';
 export * from './websocket';

package/lib/esm/getActionProcessor/webserver/index.js

@@ -1,13 +1,10 @@
-import { getExtractActionProcessor } from './extract';
 import { getServiceFunctionActionProcessor } from './serviceFunction';
 import { getWebEntryActionProcessor } from './webEntry';
 import { getWebsocketActionProcessor } from './websocket';
-export * from './extract';
 export * from './serviceFunction';
 export * from './webEntry';
 export * from './websocket';
 export const getWebserverActionProcessor = async (qpqConfig, dynamicModuleLoader) => ({
-    ...(await getExtractActionProcessor(qpqConfig, dynamicModuleLoader)),
     ...(await getWebEntryActionProcessor(qpqConfig, dynamicModuleLoader)),
     ...(await getServiceFunctionActionProcessor(qpqConfig, dynamicModuleLoader)),
     ...(await getWebsocketActionProcessor(qpqConfig, dynamicModuleLoader)),

package/lib/esm/getActionProcessor/webserver/serviceFunction/getServiceFunctionExecuteActionProcessor.js

@@ -1,5 +1,5 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
-import { actionResult, actionResultError, qpqCoreUtils, } from 'quidproquo-core';
+import { actionResult, actionResultError, qpqCoreUtils, toCrossServiceSession, } from 'quidproquo-core';
 import { ServiceFunctionActionType } from 'quidproquo-webserver';
 import { getConfigRuntimeResourceName } from '../../../awsNamingUtils';
 import { executeLambdaByName } from '../../../logic/lambda/executeLambdaByName';
@@ -13,7 +13,7 @@ const getProcessExecute = (qpqConfig) => {
         const serviceFunctionEvent = {
             functionName: functionName,
             payload: payload,
-            storySession: session,
+            storySession: toCrossServiceSession(session),
         };
         const result = await executeLambdaByName(awsFunctionName, region, serviceFunctionEvent, isAsync);
         if (!result) {

package/lib/esm/index.d.ts

@@ -8,3 +8,4 @@ export * from './logic';
 export * from './logic/cache/memoFunc';
 export * from './logic/parametersManager/getParameter';
 export * from './logic/parametersManager/getParameters';
+export * from './lambdaExtensions/getLogExtensionLayerPath';

package/lib/esm/index.js

@@ -9,3 +9,6 @@ export * from './logic';
 export * from './logic/cache/memoFunc';
 export * from './logic/parametersManager/getParameter';
 export * from './logic/parametersManager/getParameters';
+// Log extension layer path + handler port. NOTE: never export the extension
+// entry (./lambdaExtensions/qpqLogExtension) -- it self-executes on import.
+export * from './lambdaExtensions/getLogExtensionLayerPath';

package/lib/esm/lambdaExtensions/getLogExtensionLayerPath.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Absolute path to the built qpq-log-extension layer directory (contains the
+ * `extensions/` folder). Produced by scripts/buildLogExtensionLayer.mjs and
+ * shipped under lib/extension-layer. Used by the CDK layer construct as the
+ * LayerVersion asset source.
+ *
+ * Resolved relative to this compiled file: lib/<format>/lambdaExtensions/<this>
+ * -> ../../extension-layer.
+ */
+export declare const getLogExtensionLayerPath: () => string;

package/lib/esm/lambdaExtensions/getLogExtensionLayerPath.js

@@ -0,0 +1,13 @@
+import path from 'path';
+/**
+ * Absolute path to the built qpq-log-extension layer directory (contains the
+ * `extensions/` folder). Produced by scripts/buildLogExtensionLayer.mjs and
+ * shipped under lib/extension-layer. Used by the CDK layer construct as the
+ * LayerVersion asset source.
+ *
+ * Resolved relative to this compiled file: lib/<format>/lambdaExtensions/<this>
+ * -> ../../extension-layer.
+ */
+export const getLogExtensionLayerPath = () => {
+    return path.resolve(__dirname, '..', '..', 'extension-layer');
+};

package/lib/esm/lambdaExtensions/logExtensionPort.d.ts

@@ -0,0 +1 @@
+export declare const LOG_EXTENSION_PORT = 9009;

package/lib/esm/lambdaExtensions/logExtensionPort.js

@@ -0,0 +1,4 @@
+// Fixed localhost port the function handler uses to reach the qpq-log-extension.
+// Hardcoded on both ends — the handler and the extension always ship together, so
+// there's no need to pass it through an env var.
+export const LOG_EXTENSION_PORT = 9009;

package/lib/esm/lambdaHandlers/getApiGatewayEventHandler.js

@@ -1,11 +1,7 @@
 import { QpqRuntimeType } from 'quidproquo-core';
 import { getApiGatewayApiEventEventProcessor } from '../getActionProcessor';
 import { getQpqLambdaRuntimeForEvent } from './helpers/getQpqLambdaRuntimeForEvent';
-export const getApiGatewayEventHandler = (dynamicModuleLoader, qpqConfig) => getQpqLambdaRuntimeForEvent(QpqRuntimeType.API, (event) => {
-    console.log('event', JSON.stringify(event, null, 2));
-    console.log(event);
-    return {
-        depth: 0,
-        context: {},
-    };
-}, getApiGatewayApiEventEventProcessor, dynamicModuleLoader, qpqConfig);
+export const getApiGatewayEventHandler = (dynamicModuleLoader, qpqConfig) => getQpqLambdaRuntimeForEvent(QpqRuntimeType.API, () => ({
+    depth: 0,
+    context: {},
+}), getApiGatewayApiEventEventProcessor, dynamicModuleLoader, qpqConfig);

package/lib/esm/lambdaHandlers/getApiGatewayEventHandler_redirect.js

@@ -1,6 +1,4 @@
 const apiGatewayEventHandler_redirect = async (event, context) => {
-    console.log('event: ', JSON.stringify(event, null, 2));
-    console.log('process.env: ', JSON.stringify(process.env, null, 2));
     const redirectConfig = JSON.parse(process.env.redirectConfig);
     // For direct urls ~ Go straight to the url
     let redirectUrl = redirectConfig.redirectUrl;

package/lib/esm/lambdaHandlers/helpers/getQpqLambdaRuntimeForEvent.js

@@ -1,4 +1,4 @@
-import { getCustomActionActionProcessor } from 'quidproquo-actionprocessor-node';
+import { getCustomActionActionProcessor } from 'quidproquo-actionprocessor-js';
 import { askProcessEvent, createRuntime, } from 'quidproquo-core';
 import { getAwsActionProcessors } from '../../getActionProcessor';
 import { dynamicModuleLoaderWarmer } from './dynamicModuleLoaderWarmer';

package/lib/esm/lambdaHandlers/helpers/logger.d.ts

@@ -1,5 +1,8 @@
 import { QPQConfig, QpqLogger, StoryResult } from 'quidproquo-core';
-export declare const storyLogger: (result: StoryResult<any>, bucketName: string, region: string) => Promise<void>;
+import { S3Client } from '@aws-sdk/client-s3';
+export declare const storyLogger: (result: StoryResult<any>, bucketName: string, s3Client: S3Client) => Promise<void>;
 export declare const storyLoggerFs: (result: StoryResult<any>) => Promise<void>;
 export declare const moveLogsToPerminateStorage: (bucketName: string, region: string) => Promise<void>;
+export declare const getS3Logger: (qpqConfig: QPQConfig) => QpqLogger;
+export declare const getS3LoggerViaExtension: (qpqConfig: QPQConfig) => QpqLogger;
 export declare const getLogger: (qpqConfig: QPQConfig) => QpqLogger;

package/lib/esm/lambdaHandlers/helpers/logger.js

@@ -1,14 +1,14 @@
-import { LogActionType, qpqCoreUtils } from 'quidproquo-core';
+import { LogActionType, QPQ_LOGS_STORAGE_DRIVE_NAME, qpqCoreUtils } from 'quidproquo-core';
 import fs from 'fs';
 import path from 'path';
 import { PutObjectCommand, S3Client } from '@aws-sdk/client-s3';
 import { getConfigRuntimeResourceName } from '../../awsNamingUtils';
+import { LOG_EXTENSION_PORT } from '../../lambdaExtensions/logExtensionPort';
 const tempDirectory = '/tmp/qpqlogs';
 import { getAwsServiceAccountInfoByDeploymentInfo, getAwsServiceAccountInfoConfig } from 'quidproquo-config-aws';
 import { filterLogHistoryByActionTypes } from 'quidproquo-core';
-export const storyLogger = async (result, bucketName, region) => {
+export const storyLogger = async (result, bucketName, s3Client) => {
     try {
-        const s3Client = new S3Client({ region });
         const commandParams = {
             Key: `${result.correlation}.json`,
             Bucket: bucketName,
@@ -37,11 +37,12 @@ export const moveLogsToPerminateStorage = async (bucketName, region) => {
     try {
         await fs.promises.mkdir(tempDirectory, { recursive: true });
         const files = await fs.promises.readdir(tempDirectory);
+        const s3Client = new S3Client({ region });
         for (const file of files) {
             const filePath = path.join(tempDirectory, file);
             const data = await fs.promises.readFile(filePath, 'utf-8');
             const result = JSON.parse(data);
-            await storyLogger(result, bucketName, region);
+            await storyLogger(result, bucketName, s3Client);
             await fs.promises.unlink(filePath);
             console.log(`Moved log file [${file}] to S3 and deleted from temporary directory`);
         }
@@ -51,49 +52,51 @@ export const moveLogsToPerminateStorage = async (bucketName, region) => {
         console.error(error);
     }
 };
-export const getLogger = (qpqConfig) => {
-    const awsSettings = getAwsServiceAccountInfoConfig(qpqConfig);
-    // If we have no log service, just return nothing.
-    if (!awsSettings.logServiceName || awsSettings.disableLogs || process.env.storageDriveName === 'qpq-logs') {
-        return {
-            enableLogs: async () => { },
-            log: async () => { },
-            waitToFinishWriting: async () => { },
-            moveToPermanentStorage: async () => { },
-        };
-    }
-    const service = awsSettings.logServiceName;
+const noopLogger = {
+    enableLogs: async () => { },
+    log: () => { },
+    waitToFinishWriting: async () => { },
+    moveToPermanentStorage: async () => { },
+};
+// Resolves which S3 bucket (and its region) story logs go to for this config.
+const resolveLogTarget = (qpqConfig) => {
+    const service = getAwsServiceAccountInfoConfig(qpqConfig).logServiceName;
     const application = qpqCoreUtils.getApplicationName(qpqConfig);
     const environment = qpqCoreUtils.getApplicationModuleEnvironment(qpqConfig);
     const feature = qpqCoreUtils.getApplicationModuleFeature(qpqConfig);
-    // Workout the bucket name.
-    const bucketName = getConfigRuntimeResourceName('qpq-logs', application, service, environment, feature);
-    // Where is this bucket?
+    const bucketName = getConfigRuntimeResourceName(QPQ_LOGS_STORAGE_DRIVE_NAME, application, service, environment, feature);
     const regionForBucket = getAwsServiceAccountInfoByDeploymentInfo(qpqConfig, service, environment, feature, application).awsRegion;
+    return { bucketName, regionForBucket };
+};
+// Shared plumbing for both loggers: defers each log to a microtask, applies the
+// disabled-correlation history filter, and tracks the promises so
+// waitToFinishWriting can await them. Only `ship` (how a log reaches S3) differs.
+const createBufferedLogger = (bucketName, regionForBucket, ship) => {
     const logs = [];
     let disabledLogCorrelations = [];
     return {
         enableLogs: async (enable, reason, correlation) => {
-            if (!enable) {
-                disabledLogCorrelations = [...disabledLogCorrelations, correlation];
-            }
-            else {
-                disabledLogCorrelations = disabledLogCorrelations.filter((dlc) => dlc !== correlation);
-            }
+            disabledLogCorrelations = enable
+                ? disabledLogCorrelations.filter((dlc) => dlc !== correlation)
+                : [...disabledLogCorrelations, correlation];
         },
-        log: async (result) => {
-            let modifyableResult = !disabledLogCorrelations.includes(result.correlation)
-                ? result
-                : {
-                    ...result,
-                    history: filterLogHistoryByActionTypes(result.history, [
-                        LogActionType.Create,
-                        LogActionType.TemplateLiteral,
-                        LogActionType.DisableEventHistory,
-                    ]),
-                };
-            // TODO: Filter and flatten histories log histories
-            const promise = storyLogger(modifyableResult, bucketName, regionForBucket).catch((e) => {
+        log: (result) => {
+            // Defer all work (including JSON.stringify) to a microtask so the caller is not blocked.
+            const promise = Promise.resolve()
+                .then(() => {
+                const modifyableResult = !disabledLogCorrelations.includes(result.correlation)
+                    ? result
+                    : {
+                        ...result,
+                        history: filterLogHistoryByActionTypes(result.history, [
+                            LogActionType.Create,
+                            LogActionType.TemplateLiteral,
+                            LogActionType.DisableEventHistory,
+                        ]),
+                    };
+                return ship(modifyableResult);
+            })
+                .catch((e) => {
                 console.log('Failed to log story result to S3', JSON.stringify(e, null, 2));
             });
             logs.push(promise);
@@ -106,3 +109,56 @@ export const getLogger = (qpqConfig) => {
         },
     };
 };
+// Logs straight to S3: the handler awaits the PutObject itself. Simple and fully
+// durable, but the invoke waits on S3. No extension required.
+export const getS3Logger = (qpqConfig) => {
+    const { bucketName, regionForBucket } = resolveLogTarget(qpqConfig);
+    const s3Client = new S3Client({ region: regionForBucket });
+    return createBufferedLogger(bucketName, regionForBucket, (result) => storyLogger(result, bucketName, s3Client));
+};
+// Logs via the qpq-log-extension: a fast local HTTP POST hands the log off so the
+// response is not blocked on S3. Falls back to a direct S3 write if the extension
+// is unreachable, so a log is never silently dropped.
+export const getS3LoggerViaExtension = (qpqConfig) => {
+    const { bucketName, regionForBucket } = resolveLogTarget(qpqConfig);
+    const s3Client = new S3Client({ region: regionForBucket });
+    const sendToExtension = async (result) => {
+        const res = await fetch(`http://127.0.0.1:${LOG_EXTENSION_PORT}/log`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                bucketName,
+                region: regionForBucket,
+                key: `${result.correlation}.json`,
+                body: JSON.stringify(result),
+                storageClass: 'INTELLIGENT_TIERING',
+            }),
+        });
+        if (!res.ok) {
+            throw new Error(`extension responded ${res.status}`);
+        }
+    };
+    return createBufferedLogger(bucketName, regionForBucket, async (result) => {
+        try {
+            await sendToExtension(result);
+        }
+        catch (error) {
+            console.log(`qpq-log-extension unreachable, writing [${result.correlation}] to S3 directly:`, error);
+            await storyLogger(result, bucketName, s3Client);
+        }
+    });
+};
+export const getLogger = (qpqConfig) => {
+    const awsSettings = getAwsServiceAccountInfoConfig(qpqConfig);
+    // If we have no log service, just return nothing.
+    if (!awsSettings.logServiceName || awsSettings.disableLogs || process.env.storageDriveName === QPQ_LOGS_STORAGE_DRIVE_NAME) {
+        return noopLogger;
+    }
+    // instantLogs forces the synchronous direct-to-S3 path, bypassing the extension.
+    if (awsSettings.instantLogs) {
+        return getS3Logger(qpqConfig);
+    }
+    // Use the off-response-path extension when running inside a real Lambda (where it
+    // is always attached); otherwise log directly to S3.
+    return process.env.AWS_LAMBDA_RUNTIME_API ? getS3LoggerViaExtension(qpqConfig) : getS3Logger(qpqConfig);
+};

package/lib/esm/logic/cognito/associateSoftwareToken.d.ts

@@ -0,0 +1,2 @@
+import { AssociateSoftwareTokenResult } from 'quidproquo-core';
+export declare const associateSoftwareToken: (region: string, session: string) => Promise<AssociateSoftwareTokenResult>;

package/lib/esm/logic/cognito/associateSoftwareToken.js

@@ -0,0 +1,15 @@
+import { AssociateSoftwareTokenCommand, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';
+import { createAwsClient } from '../createAwsClient';
+// Begins TOTP enrollment for the MFA_SETUP challenge. Cognito returns the
+// shared secret to seed the authenticator app and a refreshed session that must
+// be used for the subsequent VerifySoftwareToken / RespondToAuthChallenge calls.
+export const associateSoftwareToken = async (region, session) => {
+    const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {
+        region,
+    });
+    const response = await cognitoClient.send(new AssociateSoftwareTokenCommand({ Session: session }));
+    return {
+        secretCode: response.SecretCode || '',
+        session: response.Session || '',
+    };
+};

package/lib/esm/logic/cognito/decodeValidJwt.js

@@ -27,7 +27,8 @@ export const decodeValidJwt = async (userPoolId, region, ignoreExpiration, acces
         return decodedAccessToken;
     }
     catch (e) {
-        console.log('Failed to decode jwt token', e);
+        const summary = e instanceof Error ? `${e.name}: ${e.message}` : 'unknown error';
+        console.log('Failed to decode jwt token:', summary);
         return null;
     }
 };