quidproquo-actionprocessor-awslambda 0.0.263 → 0.1.1

package/lib/esm/logic/cognito/getUserAttributesBySub.d.ts

@@ -1,2 +1,6 @@
 import { UserAttributes } from 'quidproquo-core';
+export declare class UserNotFoundError extends Error {
+    readonly code = "USER_NOT_FOUND";
+    constructor();
+}
 export declare const getUserAttributesBySub: (userPoolId: string, region: string, sub: string) => Promise<UserAttributes>;

package/lib/esm/logic/cognito/getUserAttributesBySub.js

@@ -1,6 +1,15 @@
 import { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';
 import { createAwsClient } from '../createAwsClient';
 import { getQpqAttributesFromCognitoUserAttributes } from './cognitoAttributeMap';
+// ListUsers returns an empty list rather than throwing for no match, so we throw
+// our own error with a discriminable `code` for the processor's catch to map.
+export class UserNotFoundError extends Error {
+    code = 'USER_NOT_FOUND';
+    constructor() {
+        super('User not found');
+        this.name = 'UserNotFoundError';
+    }
+}
 export const getUserAttributesBySub = async (userPoolId, region, sub) => {
     const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {
         region,
@@ -11,7 +20,7 @@ export const getUserAttributesBySub = async (userPoolId, region, sub) => {
     }));
     const [user] = response?.Users || [];
     if (!user) {
-        throw new Error('User not found');
+        throw new UserNotFoundError();
     }
     const validAttributes = (user.Attributes || []).filter((attr) => attr.Name && attr.Value);
     return getQpqAttributesFromCognitoUserAttributes(validAttributes);

package/lib/esm/logic/cognito/utils/transformCognitoResponse.js

@@ -21,6 +21,8 @@ export const cognitoChallengeNameTypeToQpqAuthenticateUserChallenge = (cognitoCh
     const map = {
         [ChallengeNameType.NEW_PASSWORD_REQUIRED]: AuthenticateUserChallenge.NEW_PASSWORD_REQUIRED,
         [ChallengeNameType.CUSTOM_CHALLENGE]: AuthenticateUserChallenge.CUSTOM_CHALLENGE,
+        [ChallengeNameType.SOFTWARE_TOKEN_MFA]: AuthenticateUserChallenge.SOFTWARE_TOKEN_MFA,
+        [ChallengeNameType.MFA_SETUP]: AuthenticateUserChallenge.MFA_SETUP,
     };
     // TODO: handle the NOT-IMP cases
     const challenge = map[cognitoChallengeName] || `QPQ-NOT-IMP-${cognitoChallengeName}`;

package/lib/esm/logic/cognito/verifySoftwareToken.d.ts

@@ -0,0 +1 @@
+export declare const verifySoftwareToken: (region: string, session: string, userCode: string) => Promise<string>;

package/lib/esm/logic/cognito/verifySoftwareToken.js

@@ -0,0 +1,15 @@
+import { CognitoIdentityProviderClient, VerifySoftwareTokenCommand } from '@aws-sdk/client-cognito-identity-provider';
+import { createAwsClient } from '../createAwsClient';
+// Verifies the first TOTP code during MFA_SETUP. On success Cognito returns a
+// fresh session that must be passed to RespondToAuthChallenge to complete login.
+// A bad code throws (e.g. CodeMismatchException / EnableSoftwareTokenMFAException).
+export const verifySoftwareToken = async (region, session, userCode) => {
+    const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {
+        region,
+    });
+    const response = await cognitoClient.send(new VerifySoftwareTokenCommand({
+        Session: session,
+        UserCode: userCode,
+    }));
+    return response.Session || '';
+};

package/lib/esm/logic/dynamo/qpqDynamoOrm/getDynamoTableIndexByConfigAndQuery.js

@@ -11,12 +11,17 @@ export const getDynamoTableIndexByConfigAndQuery = (setting, query) => {
         return [];
     };
     const queriedKeys = extractKeysFromQuery(query);
-    // Find a matching index
+    // If the query includes the primary sort key, the primary table is a direct match —
+    // prefer it over any GSI so we never land on a GSI with a non-SK condition.
+    const primarySortKey = setting.sortKeys[0]?.key;
+    if (primarySortKey && queriedKeys.includes(primarySortKey)) {
+        return undefined;
+    }
+    // Find a GSI whose partition key is in the query.
     for (const index of setting.indexes) {
         if (queriedKeys.includes(index.partitionKey.key)) {
             return index.partitionKey.key;
         }
     }
-    // No matching index found
     return undefined;
 };

package/lib/esm/logic/s3/generatePresignedUploadUrl.js

@@ -32,7 +32,14 @@ import { createAwsClient } from '../createAwsClient';
 //   };
 // };
 export const generatePresignedUploadUrl = async (bucketName, objectKey, region, expirationMs, correlationId, contentType) => {
-    const s3Client = createAwsClient(S3Client, { region });
+    // WHEN_REQUIRED disables the SDK v3 default request checksum (CRC32). Otherwise the
+    // presigner bakes an empty-body checksum (x-amz-checksum-crc32=AAAAAA==) into the signed
+    // URL, which never matches the real body the browser PUTs — S3 then rejects the upload and
+    // the failure surfaces in the browser as a CORS error (the error response has no ACAO header).
+    const s3Client = createAwsClient(S3Client, {
+        region,
+        requestChecksumCalculation: 'WHEN_REQUIRED',
+    });
     const putObjectCommand = new PutObjectCommand({
         Bucket: bucketName,
         Key: objectKey,

package/lib/esm/logic/s3/objectExists.js

@@ -2,15 +2,20 @@ import { S3Client } from '@aws-sdk/client-s3';
 import { HeadObjectCommand } from '@aws-sdk/client-s3';
 import { createAwsClient } from '../createAwsClient';
 export const objectExists = async (bucketName, key, region) => {
+    const s3Client = createAwsClient(S3Client, { region });
     try {
-        const s3Client = createAwsClient(S3Client, { region });
         await s3Client.send(new HeadObjectCommand({
             Key: key,
             Bucket: bucketName,
         }));
         return true;
     }
-    catch {
-        return false;
+    catch (error) {
+        // A 404 is a definitive "does not exist"; anything else (access denied,
+        // throttling, ...) must surface rather than masquerade as a missing file.
+        if (error?.name === 'NotFound' || error?.$metadata?.httpStatusCode === 404) {
+            return false;
+        }
+        throw error;
     }
 };

package/lib/extension-layer/extensions/qpq-log-extension

@@ -0,0 +1,2 @@
+#!/bin/bash
+exec /usr/bin/env node /opt/qpq-log-extension/index.js