quidproquo-actionprocessor-awslambda 0.1.10 → 0.1.12

package/lib/commonjs/logic/cognito/respondToAuthChallenge.d.ts

@@ -0,0 +1,8 @@
+import { AuthenticateUserResponse } from 'quidproquo-core';
+import { ChallengeNameType } from '@aws-sdk/client-cognito-identity-provider';
+/**
+ * Answers a pending Cognito auth challenge (new password, TOTP code, custom
+ * challenge, ...) using the session from the previous auth step. Returns either
+ * issued tokens or the next challenge.
+ */
+export declare const respondToAuthChallenge: (userPoolId: string, clientId: string, region: string, username: string, session: string, challengeNameType: ChallengeNameType, attributes: Record<string, string>) => Promise<AuthenticateUserResponse>;

package/lib/commonjs/logic/cognito/{respondToAuthChallengeChallenge.js → respondToAuthChallenge.js}

@@ -9,13 +9,18 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.respondToAuthChallengeChallenge = void 0;
+exports.respondToAuthChallenge = void 0;
 const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
 const createAwsClient_1 = require("../createAwsClient");
 const calculateSecretHash_1 = require("./utils/calculateSecretHash");
-const transformCognitoResponse_1 = require("./utils/transformCognitoResponse");
+const cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo_1 = require("./utils/cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo");
 const getUserPoolClientSecret_1 = require("./getUserPoolClientSecret");
-const respondToAuthChallengeChallenge = (userPoolId, clientId, region, username, session, challengeNameType, attributes) => __awaiter(void 0, void 0, void 0, function* () {
+/**
+ * Answers a pending Cognito auth challenge (new password, TOTP code, custom
+ * challenge, ...) using the session from the previous auth step. Returns either
+ * issued tokens or the next challenge.
+ */
+const respondToAuthChallenge = (userPoolId, clientId, region, username, session, challengeNameType, attributes) => __awaiter(void 0, void 0, void 0, function* () {
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
         region,
     });
@@ -27,10 +32,11 @@ const respondToAuthChallengeChallenge = (userPoolId, clientId, region, username,
         Session: session,
         ChallengeResponses: Object.assign({ USERNAME: username, SECRET_HASH: secretHash }, attributes),
     };
+    // Token expiry is computed relative to this; captured before the call so the
+    // derived expiresAt errs early rather than late.
     const issueDateTime = new Date().toISOString();
     const response = yield cognitoClient.send(new client_cognito_identity_provider_1.RespondToAuthChallengeCommand(params));
-    // transform the response into your custom format, similar to your refreshToken function
-    return (0, transformCognitoResponse_1.cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo)(response, issueDateTime);
+    return (0, cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo_1.cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo)(response, issueDateTime);
 });
-exports.respondToAuthChallengeChallenge = respondToAuthChallengeChallenge;
-//# sourceMappingURL=respondToAuthChallengeChallenge.js.map
+exports.respondToAuthChallenge = respondToAuthChallenge;
+//# sourceMappingURL=respondToAuthChallenge.js.map

package/lib/commonjs/logic/cognito/respondToAuthChallenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"respondToAuthChallenge.js","sourceRoot":"","sources":["../../../../src/logic/cognito/respondToAuthChallenge.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAKmD;AAEnD,wDAAqD;AACrD,qEAAkE;AAClE,6IAA0I;AAC1I,uEAAoE;AAEpE;;;;GAIG;AACI,MAAM,sBAAsB,GAAG,CACpC,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,QAAgB,EAChB,OAAe,EACf,iBAAoC,EACpC,UAAkC,EACC,EAAE;IACrC,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,IAAA,iDAAuB,EAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,IAAA,yCAAmB,EAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAuC;QACjD,aAAa,EAAE,iBAAiB;QAChC,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,OAAO;QAChB,kBAAkB,kBAChB,QAAQ,EAAE,QAAQ,EAClB,WAAW,EAAE,UAAU,IAEpB,UAAU,CACd;KACF,CAAC;IAEF,6EAA6E;IAC7E,iDAAiD;IACjD,MAAM,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,gEAA6B,CAAC,MAAM,CAAC,CAAC,CAAC;IAErF,OAAO,IAAA,iHAAuD,EAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AAC1F,CAAC,CAAA,CAAC;AAlCW,QAAA,sBAAsB,0BAkCjC","sourcesContent":["import { AuthenticateUserResponse } from 'quidproquo-core';\n\nimport {\n  ChallengeNameType,\n  CognitoIdentityProviderClient,\n  RespondToAuthChallengeCommand,\n  RespondToAuthChallengeCommandInput,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo } from './utils/cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\n/**\n * Answers a pending Cognito auth challenge (new password, TOTP code, custom\n * challenge, ...) using the session from the previous auth step. Returns either\n * issued tokens or the next challenge.\n */\nexport const respondToAuthChallenge = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  username: string,\n  session: string,\n  challengeNameType: ChallengeNameType,\n  attributes: Record<string, string>,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  const params: RespondToAuthChallengeCommandInput = {\n    ChallengeName: challengeNameType,\n    ClientId: clientId,\n    Session: session,\n    ChallengeResponses: {\n      USERNAME: username,\n      SECRET_HASH: secretHash,\n\n      ...attributes,\n    },\n  };\n\n  // Token expiry is computed relative to this; captured before the call so the\n  // derived expiresAt errs early rather than late.\n  const issueDateTime = new Date().toISOString();\n  const response = await cognitoClient.send(new RespondToAuthChallengeCommand(params));\n\n  return cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo(response, issueDateTime);\n};\n"]}

package/lib/commonjs/logic/cognito/setUserAttributes.js

@@ -23,18 +23,18 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.setUserAttributes = void 0;
 const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
 const createAwsClient_1 = require("../createAwsClient");
-const cognitoAttributeMap_1 = require("./cognitoAttributeMap");
+const getCognitoUserAttributesFromQpqUserAttributes_1 = require("./getCognitoUserAttributesFromQpqUserAttributes");
 const setUserAttributes = (userPoolId, region, username, userAttributes) => __awaiter(void 0, void 0, void 0, function* () {
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
         region,
     });
+    // userId maps to the immutable sub attribute, so it must never be written back.
     const { userId } = userAttributes, writeableUserAttributes = __rest(userAttributes, ["userId"]);
-    const params = {
+    yield cognitoClient.send(new client_cognito_identity_provider_1.AdminUpdateUserAttributesCommand({
         UserPoolId: userPoolId,
         Username: username,
-        UserAttributes: (0, cognitoAttributeMap_1.getCognitoUserAttributesFromQpqUserAttributes)(writeableUserAttributes),
-    };
-    yield cognitoClient.send(new client_cognito_identity_provider_1.AdminUpdateUserAttributesCommand(params));
+        UserAttributes: (0, getCognitoUserAttributesFromQpqUserAttributes_1.getCognitoUserAttributesFromQpqUserAttributes)(writeableUserAttributes),
+    }));
 });
 exports.setUserAttributes = setUserAttributes;
 //# sourceMappingURL=setUserAttributes.js.map

package/lib/commonjs/logic/cognito/setUserAttributes.js.map

@@ -1 +1 @@
-{"version":3,"file":"setUserAttributes.js","sourceRoot":"","sources":["../../../../src/logic/cognito/setUserAttributes.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAEA,gGAA2I;AAE3I,wDAAqD;AACrD,+DAAsF;AAE/E,MAAM,iBAAiB,GAAG,CAAO,UAAkB,EAAE,MAAc,EAAE,QAAgB,EAAE,cAA8B,EAAiB,EAAE;IAC7I,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,EAAE,MAAM,KAAiC,cAAc,EAA1C,uBAAuB,UAAK,cAAc,EAAvD,UAAsC,CAAiB,CAAC;IAE9D,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAClB,cAAc,EAAE,IAAA,mEAA6C,EAAC,uBAAuB,CAAC;KACvF,CAAC;IAEF,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,mEAAgC,CAAC,MAAM,CAAC,CAAC,CAAC;AACzE,CAAC,CAAA,CAAC;AAdW,QAAA,iBAAiB,qBAc5B","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { AdminUpdateUserAttributesCommand, AttributeType, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getCognitoUserAttributesFromQpqUserAttributes } from './cognitoAttributeMap';\n\nexport const setUserAttributes = async (userPoolId: string, region: string, username: string, userAttributes: UserAttributes): Promise<void> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const { userId, ...writeableUserAttributes } = userAttributes;\n\n  const params = {\n    UserPoolId: userPoolId,\n    Username: username,\n    UserAttributes: getCognitoUserAttributesFromQpqUserAttributes(writeableUserAttributes),\n  };\n\n  await cognitoClient.send(new AdminUpdateUserAttributesCommand(params));\n};\n"]}
+{"version":3,"file":"setUserAttributes.js","sourceRoot":"","sources":["../../../../src/logic/cognito/setUserAttributes.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAEA,gGAA4H;AAE5H,wDAAqD;AACrD,mHAAgH;AAEzG,MAAM,iBAAiB,GAAG,CAAO,UAAkB,EAAE,MAAc,EAAE,QAAgB,EAAE,cAA8B,EAAiB,EAAE;IAC7I,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,gFAAgF;IAChF,MAAM,EAAE,MAAM,KAAiC,cAAc,EAA1C,uBAAuB,UAAK,cAAc,EAAvD,UAAsC,CAAiB,CAAC;IAE9D,MAAM,aAAa,CAAC,IAAI,CACtB,IAAI,mEAAgC,CAAC;QACnC,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAClB,cAAc,EAAE,IAAA,6FAA6C,EAAC,uBAAuB,CAAC;KACvF,CAAC,CACH,CAAC;AACJ,CAAC,CAAA,CAAC;AAfW,QAAA,iBAAiB,qBAe5B","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { AdminUpdateUserAttributesCommand, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getCognitoUserAttributesFromQpqUserAttributes } from './getCognitoUserAttributesFromQpqUserAttributes';\n\nexport const setUserAttributes = async (userPoolId: string, region: string, username: string, userAttributes: UserAttributes): Promise<void> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  // userId maps to the immutable sub attribute, so it must never be written back.\n  const { userId, ...writeableUserAttributes } = userAttributes;\n\n  await cognitoClient.send(\n    new AdminUpdateUserAttributesCommand({\n      UserPoolId: userPoolId,\n      Username: username,\n      UserAttributes: getCognitoUserAttributesFromQpqUserAttributes(writeableUserAttributes),\n    }),\n  );\n};\n"]}

package/lib/commonjs/logic/cognito/setUserPassword.js

@@ -16,11 +16,12 @@ const setUserPassword = (region, userPoolId, username, password) => __awaiter(vo
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
         region,
     });
-    // There has to be a better way than this?
     const passwordParams = {
         Password: password,
         Username: username,
         UserPoolId: userPoolId,
+        // Activate the password immediately rather than leaving the user in the
+        // FORCE_CHANGE_PASSWORD state a temporary password would.
         Permanent: true,
     };
     yield cognitoClient.send(new client_cognito_identity_provider_1.AdminSetUserPasswordCommand(passwordParams));

package/lib/commonjs/logic/cognito/setUserPassword.js.map

@@ -1 +1 @@
-{"version":3,"file":"setUserPassword.js","sourceRoot":"","sources":["../../../../src/logic/cognito/setUserPassword.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gGAImD;AAEnD,wDAAqD;AAE9C,MAAM,eAAe,GAAG,CAAO,MAAc,EAAE,UAAkB,EAAE,QAAgB,EAAE,QAAgB,EAAE,EAAE;IAC9G,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,0CAA0C;IAC1C,MAAM,cAAc,GAAqC;QACvD,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,UAAU;QACtB,SAAS,EAAE,IAAI;KAChB,CAAC;IAEF,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,8DAA2B,CAAC,cAAc,CAAC,CAAC,CAAC;AAC5E,CAAC,CAAA,CAAC;AAdW,QAAA,eAAe,mBAc1B","sourcesContent":["import {\n  AdminSetUserPasswordCommand,\n  AdminSetUserPasswordCommandInput,\n  CognitoIdentityProviderClient,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\n\nexport const setUserPassword = async (region: string, userPoolId: string, username: string, password: string) => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  // There has to be a better way than this?\n  const passwordParams: AdminSetUserPasswordCommandInput = {\n    Password: password,\n    Username: username,\n    UserPoolId: userPoolId,\n    Permanent: true,\n  };\n\n  await cognitoClient.send(new AdminSetUserPasswordCommand(passwordParams));\n};\n"]}
+{"version":3,"file":"setUserPassword.js","sourceRoot":"","sources":["../../../../src/logic/cognito/setUserPassword.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gGAImD;AAEnD,wDAAqD;AAE9C,MAAM,eAAe,GAAG,CAAO,MAAc,EAAE,UAAkB,EAAE,QAAgB,EAAE,QAAgB,EAAiB,EAAE;IAC7H,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,cAAc,GAAqC;QACvD,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,UAAU;QACtB,wEAAwE;QACxE,0DAA0D;QAC1D,SAAS,EAAE,IAAI;KAChB,CAAC;IAEF,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,8DAA2B,CAAC,cAAc,CAAC,CAAC,CAAC;AAC5E,CAAC,CAAA,CAAC;AAfW,QAAA,eAAe,mBAe1B","sourcesContent":["import {\n  AdminSetUserPasswordCommand,\n  AdminSetUserPasswordCommandInput,\n  CognitoIdentityProviderClient,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\n\nexport const setUserPassword = async (region: string, userPoolId: string, username: string, password: string): Promise<void> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const passwordParams: AdminSetUserPasswordCommandInput = {\n    Password: password,\n    Username: username,\n    UserPoolId: userPoolId,\n    // Activate the password immediately rather than leaving the user in the\n    // FORCE_CHANGE_PASSWORD state a temporary password would.\n    Permanent: true,\n  };\n\n  await cognitoClient.send(new AdminSetUserPasswordCommand(passwordParams));\n};\n"]}

package/lib/commonjs/logic/cognito/utils/CognitoUserAttribute.d.ts

@@ -0,0 +1,5 @@
+/** A Cognito user attribute that is guaranteed to carry both a name and a value. */
+export type CognitoUserAttribute = {
+    Name: string;
+    Value: string;
+};

package/lib/commonjs/logic/cognito/utils/CognitoUserAttribute.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=CognitoUserAttribute.js.map

package/lib/commonjs/logic/cognito/utils/CognitoUserAttribute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CognitoUserAttribute.js","sourceRoot":"","sources":["../../../../../src/logic/cognito/utils/CognitoUserAttribute.ts"],"names":[],"mappings":"","sourcesContent":["/** A Cognito user attribute that is guaranteed to carry both a name and a value. */\nexport type CognitoUserAttribute = {\n  Name: string;\n  Value: string;\n};\n"]}

package/lib/commonjs/logic/cognito/utils/buildCognitoUserFilter.d.ts

@@ -0,0 +1,10 @@
+export declare class InvalidCognitoFilterError extends Error {
+    readonly code = "INVALID_COGNITO_FILTER";
+    constructor(message: string);
+}
+/**
+ * Builds a Cognito ListUsers exact-match filter (`name = "value"`), rejecting
+ * attribute names and values that cannot be embedded safely.
+ * Throws InvalidCognitoFilterError (code INVALID_COGNITO_FILTER) on unsafe input.
+ */
+export declare const buildCognitoUserFilter: (attributeName: string, attributeValue: string) => string;

package/lib/commonjs/logic/cognito/utils/buildCognitoUserFilter.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildCognitoUserFilter = exports.InvalidCognitoFilterError = void 0;
+// ListUsers filter strings are built by interpolation, so a value containing a
+// quote or backslash could break out of the quoted literal and alter the filter.
+// Cognito defines no escaping for these, so unsafe input is rejected outright.
+class InvalidCognitoFilterError extends Error {
+    constructor(message) {
+        super(message);
+        this.code = 'INVALID_COGNITO_FILTER';
+        this.name = 'InvalidCognitoFilterError';
+    }
+}
+exports.InvalidCognitoFilterError = InvalidCognitoFilterError;
+// Cognito filterable attribute names: standard attributes plus prefixed ones
+// like cognito:user_status.
+const validAttributeName = /^[a-zA-Z][a-zA-Z0-9_:]*$/;
+/**
+ * Builds a Cognito ListUsers exact-match filter (`name = "value"`), rejecting
+ * attribute names and values that cannot be embedded safely.
+ * Throws InvalidCognitoFilterError (code INVALID_COGNITO_FILTER) on unsafe input.
+ */
+const buildCognitoUserFilter = (attributeName, attributeValue) => {
+    if (!validAttributeName.test(attributeName)) {
+        throw new InvalidCognitoFilterError(`Invalid Cognito filter attribute name: ${attributeName}`);
+    }
+    // The value is deliberately not echoed into the message: it can be user input.
+    if (attributeValue.includes('"') || attributeValue.includes('\\')) {
+        throw new InvalidCognitoFilterError('Cognito filter values cannot contain quotes or backslashes');
+    }
+    return `${attributeName} = "${attributeValue}"`;
+};
+exports.buildCognitoUserFilter = buildCognitoUserFilter;
+//# sourceMappingURL=buildCognitoUserFilter.js.map

package/lib/commonjs/logic/cognito/utils/buildCognitoUserFilter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildCognitoUserFilter.js","sourceRoot":"","sources":["../../../../../src/logic/cognito/utils/buildCognitoUserFilter.ts"],"names":[],"mappings":";;;AAAA,+EAA+E;AAC/E,iFAAiF;AACjF,+EAA+E;AAC/E,MAAa,yBAA0B,SAAQ,KAAK;IAGlD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QAHR,SAAI,GAAG,wBAAwB,CAAC;QAIvC,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAPD,8DAOC;AAED,6EAA6E;AAC7E,4BAA4B;AAC5B,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAEtD;;;;GAIG;AACI,MAAM,sBAAsB,GAAG,CAAC,aAAqB,EAAE,cAAsB,EAAU,EAAE;IAC9F,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,yBAAyB,CAAC,0CAA0C,aAAa,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,+EAA+E;IAC/E,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,yBAAyB,CAAC,4DAA4D,CAAC,CAAC;IACpG,CAAC;IAED,OAAO,GAAG,aAAa,OAAO,cAAc,GAAG,CAAC;AAClD,CAAC,CAAC;AAXW,QAAA,sBAAsB,0BAWjC","sourcesContent":["// ListUsers filter strings are built by interpolation, so a value containing a\n// quote or backslash could break out of the quoted literal and alter the filter.\n// Cognito defines no escaping for these, so unsafe input is rejected outright.\nexport class InvalidCognitoFilterError extends Error {\n  readonly code = 'INVALID_COGNITO_FILTER';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'InvalidCognitoFilterError';\n  }\n}\n\n// Cognito filterable attribute names: standard attributes plus prefixed ones\n// like cognito:user_status.\nconst validAttributeName = /^[a-zA-Z][a-zA-Z0-9_:]*$/;\n\n/**\n * Builds a Cognito ListUsers exact-match filter (`name = \"value\"`), rejecting\n * attribute names and values that cannot be embedded safely.\n * Throws InvalidCognitoFilterError (code INVALID_COGNITO_FILTER) on unsafe input.\n */\nexport const buildCognitoUserFilter = (attributeName: string, attributeValue: string): string => {\n  if (!validAttributeName.test(attributeName)) {\n    throw new InvalidCognitoFilterError(`Invalid Cognito filter attribute name: ${attributeName}`);\n  }\n\n  // The value is deliberately not echoed into the message: it can be user input.\n  if (attributeValue.includes('\"') || attributeValue.includes('\\\\')) {\n    throw new InvalidCognitoFilterError('Cognito filter values cannot contain quotes or backslashes');\n  }\n\n  return `${attributeName} = \"${attributeValue}\"`;\n};\n"]}

package/lib/commonjs/logic/cognito/utils/calculateSecretHash.d.ts

@@ -1 +1,6 @@
+/**
+ * Computes the Cognito SECRET_HASH for an app client with a secret: the base64
+ * HMAC-SHA256 of username + clientId, keyed by the client secret. Memoized
+ * because every auth call for the same user recomputes the same value.
+ */
 export declare const calculateSecretHash: (username: string, clientId: string, clientSecret: string) => string;

package/lib/commonjs/logic/cognito/utils/calculateSecretHash.js

@@ -3,12 +3,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.calculateSecretHash = void 0;
 const crypto_1 = require("crypto");
 const memoFunc_1 = require("../../cache/memoFunc");
+/**
+ * Computes the Cognito SECRET_HASH for an app client with a secret: the base64
+ * HMAC-SHA256 of username + clientId, keyed by the client secret. Memoized
+ * because every auth call for the same user recomputes the same value.
+ */
 exports.calculateSecretHash = (0, memoFunc_1.memoFunc)((username, clientId, clientSecret) => {
-    // create the hmac with the sha256 algorithm and a secret key
-    const hasher = (0, crypto_1.createHmac)('sha256', clientSecret);
-    // add the value we want to hash
-    hasher.update(`${username}${clientId}`);
-    // get the hashed value as base64
-    return hasher.digest('base64');
+    return (0, crypto_1.createHmac)('sha256', clientSecret).update(`${username}${clientId}`).digest('base64');
 });
 //# sourceMappingURL=calculateSecretHash.js.map

package/lib/commonjs/logic/cognito/utils/calculateSecretHash.js.map

@@ -1 +1 @@
-{"version":3,"file":"calculateSecretHash.js","sourceRoot":"","sources":["../../../../../src/logic/cognito/utils/calculateSecretHash.ts"],"names":[],"mappings":";;;AAAA,mCAAoC;AAEpC,mDAAgD;AAEnC,QAAA,mBAAmB,GAAG,IAAA,mBAAQ,EAAC,CAAC,QAAgB,EAAE,QAAgB,EAAE,YAAoB,EAAE,EAAE;IACvG,6DAA6D;IAC7D,MAAM,MAAM,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAElD,gCAAgC;IAChC,MAAM,CAAC,MAAM,CAAC,GAAG,QAAQ,GAAG,QAAQ,EAAE,CAAC,CAAC;IAExC,iCAAiC;IACjC,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC,CAAC,CAAC","sourcesContent":["import { createHmac } from 'crypto';\n\nimport { memoFunc } from '../../cache/memoFunc';\n\nexport const calculateSecretHash = memoFunc((username: string, clientId: string, clientSecret: string) => {\n  // create the hmac with the sha256 algorithm and a secret key\n  const hasher = createHmac('sha256', clientSecret);\n\n  // add the value we want to hash\n  hasher.update(`${username}${clientId}`);\n\n  // get the hashed value as base64\n  return hasher.digest('base64');\n});\n"]}
+{"version":3,"file":"calculateSecretHash.js","sourceRoot":"","sources":["../../../../../src/logic/cognito/utils/calculateSecretHash.ts"],"names":[],"mappings":";;;AAAA,mCAAoC;AAEpC,mDAAgD;AAEhD;;;;GAIG;AACU,QAAA,mBAAmB,GAAG,IAAA,mBAAQ,EAAC,CAAC,QAAgB,EAAE,QAAgB,EAAE,YAAoB,EAAU,EAAE;IAC/G,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,GAAG,QAAQ,GAAG,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC9F,CAAC,CAAC,CAAC","sourcesContent":["import { createHmac } from 'crypto';\n\nimport { memoFunc } from '../../cache/memoFunc';\n\n/**\n * Computes the Cognito SECRET_HASH for an app client with a secret: the base64\n * HMAC-SHA256 of username + clientId, keyed by the client secret. Memoized\n * because every auth call for the same user recomputes the same value.\n */\nexport const calculateSecretHash = memoFunc((username: string, clientId: string, clientSecret: string): string => {\n  return createHmac('sha256', clientSecret).update(`${username}${clientId}`).digest('base64');\n});\n"]}

package/lib/commonjs/logic/cognito/utils/cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo.d.ts

@@ -0,0 +1,8 @@
+import { AuthenticateUserResponse } from 'quidproquo-core';
+import { AdminInitiateAuthResponse } from '@aws-sdk/client-cognito-identity-provider';
+/**
+ * Maps a Cognito InitiateAuth/RespondToAuthChallenge response onto the qpq
+ * AuthenticateUserResponse: pending-challenge state plus, once Cognito issues
+ * tokens, the authentication info with expiry anchored to issueDateTime.
+ */
+export declare const cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo: (authResponse: AdminInitiateAuthResponse, issueDateTime: string) => AuthenticateUserResponse;

package/lib/commonjs/logic/cognito/utils/cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo = void 0;
+const cognitoAuthenticationResultTypeToQpqAuthenticationInfo_1 = require("./cognitoAuthenticationResultTypeToQpqAuthenticationInfo");
+const cognitoChallengeNameTypeToQpqAuthenticateUserChallenge_1 = require("./cognitoChallengeNameTypeToQpqAuthenticateUserChallenge");
+/**
+ * Maps a Cognito InitiateAuth/RespondToAuthChallenge response onto the qpq
+ * AuthenticateUserResponse: pending-challenge state plus, once Cognito issues
+ * tokens, the authentication info with expiry anchored to issueDateTime.
+ */
+const cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo = (authResponse, issueDateTime) => {
+    const res = {
+        session: authResponse.Session,
+        challenge: (0, cognitoChallengeNameTypeToQpqAuthenticateUserChallenge_1.cognitoChallengeNameTypeToQpqAuthenticateUserChallenge)(authResponse.ChallengeName),
+        challengeParameters: authResponse.ChallengeParameters,
+    };
+    if (authResponse.AuthenticationResult) {
+        res.authenticationInfo = (0, cognitoAuthenticationResultTypeToQpqAuthenticationInfo_1.cognitoAuthenticationResultTypeToQpqAuthenticationInfo)(authResponse.AuthenticationResult, issueDateTime);
+    }
+    return res;
+};
+exports.cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo = cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo;
+//# sourceMappingURL=cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo.js.map

package/lib/commonjs/logic/cognito/utils/cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo.js","sourceRoot":"","sources":["../../../../../src/logic/cognito/utils/cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo.ts"],"names":[],"mappings":";;;AAIA,qIAAkI;AAClI,qIAAkI;AAElI;;;;GAIG;AACI,MAAM,uDAAuD,GAAG,CACrE,YAAuC,EACvC,aAAqB,EACK,EAAE;IAC5B,MAAM,GAAG,GAA6B;QACpC,OAAO,EAAE,YAAY,CAAC,OAAO;QAC7B,SAAS,EAAE,IAAA,+GAAsD,EAAC,YAAY,CAAC,aAAa,CAAC;QAC7F,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;KACtD,CAAC;IAEF,IAAI,YAAY,CAAC,oBAAoB,EAAE,CAAC;QACtC,GAAG,CAAC,kBAAkB,GAAG,IAAA,+GAAsD,EAAC,YAAY,CAAC,oBAAoB,EAAE,aAAa,CAAC,CAAC;IACpI,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAfW,QAAA,uDAAuD,2DAelE","sourcesContent":["import { AuthenticateUserResponse } from 'quidproquo-core';\n\nimport { AdminInitiateAuthResponse } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { cognitoAuthenticationResultTypeToQpqAuthenticationInfo } from './cognitoAuthenticationResultTypeToQpqAuthenticationInfo';\nimport { cognitoChallengeNameTypeToQpqAuthenticateUserChallenge } from './cognitoChallengeNameTypeToQpqAuthenticateUserChallenge';\n\n/**\n * Maps a Cognito InitiateAuth/RespondToAuthChallenge response onto the qpq\n * AuthenticateUserResponse: pending-challenge state plus, once Cognito issues\n * tokens, the authentication info with expiry anchored to issueDateTime.\n */\nexport const cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo = (\n  authResponse: AdminInitiateAuthResponse,\n  issueDateTime: string,\n): AuthenticateUserResponse => {\n  const res: AuthenticateUserResponse = {\n    session: authResponse.Session,\n    challenge: cognitoChallengeNameTypeToQpqAuthenticateUserChallenge(authResponse.ChallengeName),\n    challengeParameters: authResponse.ChallengeParameters,\n  };\n\n  if (authResponse.AuthenticationResult) {\n    res.authenticationInfo = cognitoAuthenticationResultTypeToQpqAuthenticationInfo(authResponse.AuthenticationResult, issueDateTime);\n  }\n\n  return res;\n};\n"]}

package/lib/commonjs/logic/cognito/utils/cognitoAuthenticationResultTypeToQpqAuthenticationInfo.d.ts

@@ -0,0 +1,7 @@
+import { AuthenticationInfo } from 'quidproquo-core';
+import { AuthenticationResultType } from '@aws-sdk/client-cognito-identity-provider';
+/**
+ * Maps a Cognito AuthenticationResult onto qpq AuthenticationInfo, deriving the
+ * absolute expiresAt from the request issue time plus Cognito's relative ExpiresIn.
+ */
+export declare const cognitoAuthenticationResultTypeToQpqAuthenticationInfo: (authResult: AuthenticationResultType, issueDateTime: string) => AuthenticationInfo;

package/lib/commonjs/logic/cognito/utils/cognitoAuthenticationResultTypeToQpqAuthenticationInfo.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cognitoAuthenticationResultTypeToQpqAuthenticationInfo = void 0;
+const quidproquo_core_1 = require("quidproquo-core");
+/**
+ * Maps a Cognito AuthenticationResult onto qpq AuthenticationInfo, deriving the
+ * absolute expiresAt from the request issue time plus Cognito's relative ExpiresIn.
+ */
+const cognitoAuthenticationResultTypeToQpqAuthenticationInfo = (authResult, issueDateTime) => {
+    const expiryDate = new Date(issueDateTime);
+    expiryDate.setSeconds(expiryDate.getSeconds() + (authResult.ExpiresIn || 0));
+    return {
+        accessToken: authResult.AccessToken,
+        idToken: authResult.IdToken,
+        refreshToken: authResult.RefreshToken,
+        tokenType: authResult.TokenType,
+        expirationDurationInSeconds: authResult.ExpiresIn,
+        expiresAt: (0, quidproquo_core_1.getQpqIsoDateTimeFromDate)(expiryDate),
+    };
+};
+exports.cognitoAuthenticationResultTypeToQpqAuthenticationInfo = cognitoAuthenticationResultTypeToQpqAuthenticationInfo;
+//# sourceMappingURL=cognitoAuthenticationResultTypeToQpqAuthenticationInfo.js.map

package/lib/commonjs/logic/cognito/utils/cognitoAuthenticationResultTypeToQpqAuthenticationInfo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognitoAuthenticationResultTypeToQpqAuthenticationInfo.js","sourceRoot":"","sources":["../../../../../src/logic/cognito/utils/cognitoAuthenticationResultTypeToQpqAuthenticationInfo.ts"],"names":[],"mappings":";;;AAAA,qDAAgF;AAIhF;;;GAGG;AACI,MAAM,sDAAsD,GAAG,CACpE,UAAoC,EACpC,aAAqB,EACD,EAAE;IACtB,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC;IAC3C,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC;IAE7E,OAAO;QACL,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,SAAS,EAAE,UAAU,CAAC,SAAS;QAE/B,2BAA2B,EAAE,UAAU,CAAC,SAAS;QACjD,SAAS,EAAE,IAAA,2CAAyB,EAAC,UAAU,CAAC;KACjD,CAAC;AACJ,CAAC,CAAC;AAhBW,QAAA,sDAAsD,0DAgBjE","sourcesContent":["import { AuthenticationInfo, getQpqIsoDateTimeFromDate } from 'quidproquo-core';\n\nimport { AuthenticationResultType } from '@aws-sdk/client-cognito-identity-provider';\n\n/**\n * Maps a Cognito AuthenticationResult onto qpq AuthenticationInfo, deriving the\n * absolute expiresAt from the request issue time plus Cognito's relative ExpiresIn.\n */\nexport const cognitoAuthenticationResultTypeToQpqAuthenticationInfo = (\n  authResult: AuthenticationResultType,\n  issueDateTime: string,\n): AuthenticationInfo => {\n  const expiryDate = new Date(issueDateTime);\n  expiryDate.setSeconds(expiryDate.getSeconds() + (authResult.ExpiresIn || 0));\n\n  return {\n    accessToken: authResult.AccessToken,\n    idToken: authResult.IdToken,\n    refreshToken: authResult.RefreshToken,\n    tokenType: authResult.TokenType,\n\n    expirationDurationInSeconds: authResult.ExpiresIn,\n    expiresAt: getQpqIsoDateTimeFromDate(expiryDate),\n  };\n};\n"]}

package/lib/commonjs/logic/cognito/utils/cognitoChallengeNameTypeToQpqAuthenticateUserChallenge.d.ts

@@ -0,0 +1,9 @@
+import { AuthenticateUserChallenge } from 'quidproquo-core';
+import { ChallengeNameType } from '@aws-sdk/client-cognito-identity-provider';
+/**
+ * Maps a Cognito challenge name onto the qpq AuthenticateUserChallenge enum.
+ * Challenges qpq does not implement yet (e.g. SMS_MFA) come back as a
+ * `QPQ-NOT-IMP-<name>` marker so the gap is visible and searchable at the caller
+ * instead of being silently treated as NONE.
+ */
+export declare const cognitoChallengeNameTypeToQpqAuthenticateUserChallenge: (cognitoChallengeName: ChallengeNameType | string | undefined) => AuthenticateUserChallenge;

package/lib/commonjs/logic/cognito/utils/cognitoChallengeNameTypeToQpqAuthenticateUserChallenge.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cognitoChallengeNameTypeToQpqAuthenticateUserChallenge = void 0;
+const quidproquo_core_1 = require("quidproquo-core");
+const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
+const challengeMap = {
+    [client_cognito_identity_provider_1.ChallengeNameType.NEW_PASSWORD_REQUIRED]: quidproquo_core_1.AuthenticateUserChallenge.NEW_PASSWORD_REQUIRED,
+    [client_cognito_identity_provider_1.ChallengeNameType.CUSTOM_CHALLENGE]: quidproquo_core_1.AuthenticateUserChallenge.CUSTOM_CHALLENGE,
+    [client_cognito_identity_provider_1.ChallengeNameType.SOFTWARE_TOKEN_MFA]: quidproquo_core_1.AuthenticateUserChallenge.SOFTWARE_TOKEN_MFA,
+    [client_cognito_identity_provider_1.ChallengeNameType.MFA_SETUP]: quidproquo_core_1.AuthenticateUserChallenge.MFA_SETUP,
+};
+/**
+ * Maps a Cognito challenge name onto the qpq AuthenticateUserChallenge enum.
+ * Challenges qpq does not implement yet (e.g. SMS_MFA) come back as a
+ * `QPQ-NOT-IMP-<name>` marker so the gap is visible and searchable at the caller
+ * instead of being silently treated as NONE.
+ */
+const cognitoChallengeNameTypeToQpqAuthenticateUserChallenge = (cognitoChallengeName) => {
+    if (!cognitoChallengeName) {
+        return quidproquo_core_1.AuthenticateUserChallenge.NONE;
+    }
+    // The marker is not a real enum member; the cast keeps the return type honest
+    // for implemented challenges while letting the marker flow through.
+    return challengeMap[cognitoChallengeName] || `QPQ-NOT-IMP-${cognitoChallengeName}`;
+};
+exports.cognitoChallengeNameTypeToQpqAuthenticateUserChallenge = cognitoChallengeNameTypeToQpqAuthenticateUserChallenge;
+//# sourceMappingURL=cognitoChallengeNameTypeToQpqAuthenticateUserChallenge.js.map

package/lib/commonjs/logic/cognito/utils/cognitoChallengeNameTypeToQpqAuthenticateUserChallenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognitoChallengeNameTypeToQpqAuthenticateUserChallenge.js","sourceRoot":"","sources":["../../../../../src/logic/cognito/utils/cognitoChallengeNameTypeToQpqAuthenticateUserChallenge.ts"],"names":[],"mappings":";;;AAAA,qDAA4D;AAE5D,gGAA8E;AAE9E,MAAM,YAAY,GAA8C;IAC9D,CAAC,oDAAiB,CAAC,qBAAqB,CAAC,EAAE,2CAAyB,CAAC,qBAAqB;IAC1F,CAAC,oDAAiB,CAAC,gBAAgB,CAAC,EAAE,2CAAyB,CAAC,gBAAgB;IAChF,CAAC,oDAAiB,CAAC,kBAAkB,CAAC,EAAE,2CAAyB,CAAC,kBAAkB;IACpF,CAAC,oDAAiB,CAAC,SAAS,CAAC,EAAE,2CAAyB,CAAC,SAAS;CACnE,CAAC;AAEF;;;;;GAKG;AACI,MAAM,sDAAsD,GAAG,CACpE,oBAA4D,EACjC,EAAE;IAC7B,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,OAAO,2CAAyB,CAAC,IAAI,CAAC;IACxC,CAAC;IAED,8EAA8E;IAC9E,oEAAoE;IACpE,OAAO,YAAY,CAAC,oBAAoB,CAAC,IAAK,eAAe,oBAAoB,EAAgC,CAAC;AACpH,CAAC,CAAC;AAVW,QAAA,sDAAsD,0DAUjE","sourcesContent":["import { AuthenticateUserChallenge } from 'quidproquo-core';\n\nimport { ChallengeNameType } from '@aws-sdk/client-cognito-identity-provider';\n\nconst challengeMap: Record<string, AuthenticateUserChallenge> = {\n  [ChallengeNameType.NEW_PASSWORD_REQUIRED]: AuthenticateUserChallenge.NEW_PASSWORD_REQUIRED,\n  [ChallengeNameType.CUSTOM_CHALLENGE]: AuthenticateUserChallenge.CUSTOM_CHALLENGE,\n  [ChallengeNameType.SOFTWARE_TOKEN_MFA]: AuthenticateUserChallenge.SOFTWARE_TOKEN_MFA,\n  [ChallengeNameType.MFA_SETUP]: AuthenticateUserChallenge.MFA_SETUP,\n};\n\n/**\n * Maps a Cognito challenge name onto the qpq AuthenticateUserChallenge enum.\n * Challenges qpq does not implement yet (e.g. SMS_MFA) come back as a\n * `QPQ-NOT-IMP-<name>` marker so the gap is visible and searchable at the caller\n * instead of being silently treated as NONE.\n */\nexport const cognitoChallengeNameTypeToQpqAuthenticateUserChallenge = (\n  cognitoChallengeName: ChallengeNameType | string | undefined,\n): AuthenticateUserChallenge => {\n  if (!cognitoChallengeName) {\n    return AuthenticateUserChallenge.NONE;\n  }\n\n  // The marker is not a real enum member; the cast keeps the return type honest\n  // for implemented challenges while letting the marker flow through.\n  return challengeMap[cognitoChallengeName] || (`QPQ-NOT-IMP-${cognitoChallengeName}` as AuthenticateUserChallenge);\n};\n"]}

package/lib/commonjs/logic/cognito/utils/cognitoCodeDeliveryDetailsToQpqDeliveryDetails.d.ts

@@ -0,0 +1,7 @@
+import { AuthenticationDeliveryDetails } from 'quidproquo-core';
+import { CodeDeliveryDetailsType } from '@aws-sdk/client-cognito-identity-provider';
+/**
+ * Maps Cognito code-delivery details onto qpq AuthenticationDeliveryDetails,
+ * defaulting to email delivery when Cognito omits any of the details.
+ */
+export declare const cognitoCodeDeliveryDetailsToQpqDeliveryDetails: (details: CodeDeliveryDetailsType | undefined) => AuthenticationDeliveryDetails;

package/lib/commonjs/logic/cognito/utils/cognitoCodeDeliveryDetailsToQpqDeliveryDetails.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cognitoCodeDeliveryDetailsToQpqDeliveryDetails = void 0;
+/**
+ * Maps Cognito code-delivery details onto qpq AuthenticationDeliveryDetails,
+ * defaulting to email delivery when Cognito omits any of the details.
+ */
+const cognitoCodeDeliveryDetailsToQpqDeliveryDetails = (details) => ({
+    attributeName: (details === null || details === void 0 ? void 0 : details.AttributeName) || 'email',
+    destination: (details === null || details === void 0 ? void 0 : details.Destination) || 'unknown@email.com',
+    deliveryMedium: (details === null || details === void 0 ? void 0 : details.DeliveryMedium) === 'SMS' ? 'SMS' : 'EMAIL',
+});
+exports.cognitoCodeDeliveryDetailsToQpqDeliveryDetails = cognitoCodeDeliveryDetailsToQpqDeliveryDetails;
+//# sourceMappingURL=cognitoCodeDeliveryDetailsToQpqDeliveryDetails.js.map

package/lib/commonjs/logic/cognito/utils/cognitoCodeDeliveryDetailsToQpqDeliveryDetails.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognitoCodeDeliveryDetailsToQpqDeliveryDetails.js","sourceRoot":"","sources":["../../../../../src/logic/cognito/utils/cognitoCodeDeliveryDetailsToQpqDeliveryDetails.ts"],"names":[],"mappings":";;;AAIA;;;GAGG;AACI,MAAM,8CAA8C,GAAG,CAAC,OAA4C,EAAiC,EAAE,CAAC,CAAC;IAC9I,aAAa,EAAE,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,KAAI,OAAO;IAChD,WAAW,EAAE,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,WAAW,KAAI,mBAAmB;IACxD,cAAc,EAAE,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,cAAc,MAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO;CACpE,CAAC,CAAC;AAJU,QAAA,8CAA8C,kDAIxD","sourcesContent":["import { AuthenticationDeliveryDetails } from 'quidproquo-core';\n\nimport { CodeDeliveryDetailsType } from '@aws-sdk/client-cognito-identity-provider';\n\n/**\n * Maps Cognito code-delivery details onto qpq AuthenticationDeliveryDetails,\n * defaulting to email delivery when Cognito omits any of the details.\n */\nexport const cognitoCodeDeliveryDetailsToQpqDeliveryDetails = (details: CodeDeliveryDetailsType | undefined): AuthenticationDeliveryDetails => ({\n  attributeName: details?.AttributeName || 'email',\n  destination: details?.Destination || 'unknown@email.com',\n  deliveryMedium: details?.DeliveryMedium === 'SMS' ? 'SMS' : 'EMAIL',\n});\n"]}

package/lib/commonjs/logic/cognito/utils/getValidCognitoUserAttributes.d.ts

@@ -0,0 +1,7 @@
+import { AttributeType } from '@aws-sdk/client-cognito-identity-provider';
+import { CognitoUserAttribute } from './CognitoUserAttribute';
+/**
+ * Narrows the SDK's AttributeType[] (where Name and Value are both optional) down
+ * to the attributes that actually carry a name and a value.
+ */
+export declare const getValidCognitoUserAttributes: (attributes: AttributeType[] | undefined) => CognitoUserAttribute[];

package/lib/commonjs/logic/cognito/utils/getValidCognitoUserAttributes.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getValidCognitoUserAttributes = void 0;
+/**
+ * Narrows the SDK's AttributeType[] (where Name and Value are both optional) down
+ * to the attributes that actually carry a name and a value.
+ */
+const getValidCognitoUserAttributes = (attributes) => (attributes || []).filter((attribute) => !!attribute.Name && !!attribute.Value);
+exports.getValidCognitoUserAttributes = getValidCognitoUserAttributes;
+//# sourceMappingURL=getValidCognitoUserAttributes.js.map

package/lib/commonjs/logic/cognito/utils/getValidCognitoUserAttributes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getValidCognitoUserAttributes.js","sourceRoot":"","sources":["../../../../../src/logic/cognito/utils/getValidCognitoUserAttributes.ts"],"names":[],"mappings":";;;AAIA;;;GAGG;AACI,MAAM,6BAA6B,GAAG,CAAC,UAAuC,EAA0B,EAAE,CAC/G,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAqC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AADxG,QAAA,6BAA6B,iCAC2E","sourcesContent":["import { AttributeType } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { CognitoUserAttribute } from './CognitoUserAttribute';\n\n/**\n * Narrows the SDK's AttributeType[] (where Name and Value are both optional) down\n * to the attributes that actually carry a name and a value.\n */\nexport const getValidCognitoUserAttributes = (attributes: AttributeType[] | undefined): CognitoUserAttribute[] =>\n  (attributes || []).filter((attribute): attribute is CognitoUserAttribute => !!attribute.Name && !!attribute.Value);\n"]}

package/lib/commonjs/logic/cognito/utils/index.d.ts

@@ -1,4 +1,10 @@
+export * from './buildCognitoUserFilter';
 export * from './calculateSecretHash';
+export * from './cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo';
+export * from './cognitoAuthenticationResultTypeToQpqAuthenticationInfo';
+export * from './cognitoChallengeNameTypeToQpqAuthenticateUserChallenge';
+export * from './cognitoCodeDeliveryDetailsToQpqDeliveryDetails';
+export * from './CognitoUserAttribute';
+export * from './getValidCognitoUserAttributes';
 export * from './pageKeyToPaginationToken';
 export * from './paginationTokenToPageKey';
-export * from './transformCognitoResponse';

package/lib/commonjs/logic/cognito/utils/index.js

@@ -14,8 +14,14 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./buildCognitoUserFilter"), exports);
 __exportStar(require("./calculateSecretHash"), exports);
+__exportStar(require("./cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo"), exports);
+__exportStar(require("./cognitoAuthenticationResultTypeToQpqAuthenticationInfo"), exports);
+__exportStar(require("./cognitoChallengeNameTypeToQpqAuthenticateUserChallenge"), exports);
+__exportStar(require("./cognitoCodeDeliveryDetailsToQpqDeliveryDetails"), exports);
+__exportStar(require("./CognitoUserAttribute"), exports);
+__exportStar(require("./getValidCognitoUserAttributes"), exports);
 __exportStar(require("./pageKeyToPaginationToken"), exports);
 __exportStar(require("./paginationTokenToPageKey"), exports);
-__exportStar(require("./transformCognitoResponse"), exports);
 //# sourceMappingURL=index.js.map

package/lib/commonjs/logic/cognito/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/logic/cognito/utils/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,wDAAsC;AACtC,6DAA2C;AAC3C,6DAA2C;AAC3C,6DAA2C","sourcesContent":["export * from './calculateSecretHash';\nexport * from './pageKeyToPaginationToken';\nexport * from './paginationTokenToPageKey';\nexport * from './transformCognitoResponse';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/logic/cognito/utils/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2DAAyC;AACzC,wDAAsC;AACtC,4FAA0E;AAC1E,2FAAyE;AACzE,2FAAyE;AACzE,mFAAiE;AACjE,yDAAuC;AACvC,kEAAgD;AAChD,6DAA2C;AAC3C,6DAA2C","sourcesContent":["export * from './buildCognitoUserFilter';\nexport * from './calculateSecretHash';\nexport * from './cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo';\nexport * from './cognitoAuthenticationResultTypeToQpqAuthenticationInfo';\nexport * from './cognitoChallengeNameTypeToQpqAuthenticateUserChallenge';\nexport * from './cognitoCodeDeliveryDetailsToQpqDeliveryDetails';\nexport * from './CognitoUserAttribute';\nexport * from './getValidCognitoUserAttributes';\nexport * from './pageKeyToPaginationToken';\nexport * from './paginationTokenToPageKey';\n"]}

package/lib/commonjs/logic/cognito/utils/pageKeyToPaginationToken.d.ts

@@ -1 +1,6 @@
+/**
+ * Decodes a qpq page key (base64) back into the raw Cognito PaginationToken.
+ * Returns undefined rather than null so the result can feed the SDK's optional
+ * PaginationToken field directly.
+ */
 export declare function pageKeyToPaginationToken(pageKey?: string): string | undefined;

package/lib/commonjs/logic/cognito/utils/pageKeyToPaginationToken.js

@@ -1,6 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.pageKeyToPaginationToken = pageKeyToPaginationToken;
+/**
+ * Decodes a qpq page key (base64) back into the raw Cognito PaginationToken.
+ * Returns undefined rather than null so the result can feed the SDK's optional
+ * PaginationToken field directly.
+ */
 function pageKeyToPaginationToken(pageKey) {
     if (!pageKey) {
         return undefined;

package/lib/commonjs/logic/cognito/utils/pageKeyToPaginationToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"pageKeyToPaginationToken.js","sourceRoot":"","sources":["../../../../../src/logic/cognito/utils/pageKeyToPaginationToken.ts"],"names":[],"mappings":";;AAAA,4DAMC;AAND,SAAgB,wBAAwB,CAAC,OAAgB;IACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;AACnD,CAAC","sourcesContent":["export function pageKeyToPaginationToken(pageKey?: string): string | undefined {\n  if (!pageKey) {\n    return undefined;\n  }\n\n  return Buffer.from(pageKey, 'base64').toString();\n}\n"]}
+{"version":3,"file":"pageKeyToPaginationToken.js","sourceRoot":"","sources":["../../../../../src/logic/cognito/utils/pageKeyToPaginationToken.ts"],"names":[],"mappings":";;AAKA,4DAMC;AAXD;;;;GAIG;AACH,SAAgB,wBAAwB,CAAC,OAAgB;IACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;AACnD,CAAC","sourcesContent":["/**\n * Decodes a qpq page key (base64) back into the raw Cognito PaginationToken.\n * Returns undefined rather than null so the result can feed the SDK's optional\n * PaginationToken field directly.\n */\nexport function pageKeyToPaginationToken(pageKey?: string): string | undefined {\n  if (!pageKey) {\n    return undefined;\n  }\n\n  return Buffer.from(pageKey, 'base64').toString();\n}\n"]}

package/lib/commonjs/logic/cognito/utils/paginationTokenToPageKey.d.ts

@@ -1 +1,6 @@
+/**
+ * Encodes a raw Cognito PaginationToken as an opaque base64 page key for
+ * QpqPagedData. Returns undefined rather than null so the result can feed the
+ * optional nextPageKey field directly.
+ */
 export declare function paginationTokenToPageKey(paginationToken?: string): string | undefined;

package/lib/commonjs/logic/cognito/utils/paginationTokenToPageKey.js

@@ -1,6 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.paginationTokenToPageKey = paginationTokenToPageKey;
+/**
+ * Encodes a raw Cognito PaginationToken as an opaque base64 page key for
+ * QpqPagedData. Returns undefined rather than null so the result can feed the
+ * optional nextPageKey field directly.
+ */
 function paginationTokenToPageKey(paginationToken) {
     if (!paginationToken) {
         return undefined;

package/lib/commonjs/logic/cognito/utils/paginationTokenToPageKey.js.map

@@ -1 +1 @@
-{"version":3,"file":"paginationTokenToPageKey.js","sourceRoot":"","sources":["../../../../../src/logic/cognito/utils/paginationTokenToPageKey.ts"],"names":[],"mappings":";;AAAA,4DAKC;AALD,SAAgB,wBAAwB,CAAC,eAAwB;IAC/D,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC","sourcesContent":["export function paginationTokenToPageKey(paginationToken?: string): string | undefined {\n  if (!paginationToken) {\n    return undefined;\n  }\n  return Buffer.from(paginationToken).toString('base64');\n}\n"]}
+{"version":3,"file":"paginationTokenToPageKey.js","sourceRoot":"","sources":["../../../../../src/logic/cognito/utils/paginationTokenToPageKey.ts"],"names":[],"mappings":";;AAKA,4DAMC;AAXD;;;;GAIG;AACH,SAAgB,wBAAwB,CAAC,eAAwB;IAC/D,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC","sourcesContent":["/**\n * Encodes a raw Cognito PaginationToken as an opaque base64 page key for\n * QpqPagedData. Returns undefined rather than null so the result can feed the\n * optional nextPageKey field directly.\n */\nexport function paginationTokenToPageKey(paginationToken?: string): string | undefined {\n  if (!paginationToken) {\n    return undefined;\n  }\n\n  return Buffer.from(paginationToken).toString('base64');\n}\n"]}

package/lib/commonjs/logic/cognito/verifyUserEmail.d.ts

@@ -1 +1,2 @@
+/** Confirms the email attribute with the verification code sent to the user. */
 export declare const verifyUserEmail: (region: string, accessToken: string, verificationCode: string) => Promise<void>;

package/lib/commonjs/logic/cognito/verifyUserEmail.js

@@ -12,6 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.verifyUserEmail = void 0;
 const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
 const createAwsClient_1 = require("../createAwsClient");
+/** Confirms the email attribute with the verification code sent to the user. */
 const verifyUserEmail = (region, accessToken, verificationCode) => __awaiter(void 0, void 0, void 0, function* () {
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
         region,

package/lib/commonjs/logic/cognito/verifyUserEmail.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifyUserEmail.js","sourceRoot":"","sources":["../../../../src/logic/cognito/verifyUserEmail.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gGAImD;AAEnD,wDAAqD;AAE9C,MAAM,eAAe,GAAG,CAAO,MAAc,EAAE,WAAmB,EAAE,gBAAwB,EAAE,EAAE;IACrG,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAAoC;QAC9C,WAAW,EAAE,WAAW;QACxB,aAAa,EAAE,OAAO;QACtB,IAAI,EAAE,gBAAgB;KACvB,CAAC;IAEF,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,6DAA0B,CAAC,MAAM,CAAC,CAAC,CAAC;AACnE,CAAC,CAAA,CAAC;AAZW,QAAA,eAAe,mBAY1B","sourcesContent":["import {\n  CognitoIdentityProviderClient,\n  VerifyUserAttributeCommand,\n  VerifyUserAttributeCommandInput,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\n\nexport const verifyUserEmail = async (region: string, accessToken: string, verificationCode: string) => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params: VerifyUserAttributeCommandInput = {\n    AccessToken: accessToken,\n    AttributeName: 'email',\n    Code: verificationCode,\n  };\n\n  await cognitoClient.send(new VerifyUserAttributeCommand(params));\n};\n"]}
+{"version":3,"file":"verifyUserEmail.js","sourceRoot":"","sources":["../../../../src/logic/cognito/verifyUserEmail.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gGAImD;AAEnD,wDAAqD;AAErD,gFAAgF;AACzE,MAAM,eAAe,GAAG,CAAO,MAAc,EAAE,WAAmB,EAAE,gBAAwB,EAAiB,EAAE;IACpH,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAAoC;QAC9C,WAAW,EAAE,WAAW;QACxB,aAAa,EAAE,OAAO;QACtB,IAAI,EAAE,gBAAgB;KACvB,CAAC;IAEF,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,6DAA0B,CAAC,MAAM,CAAC,CAAC,CAAC;AACnE,CAAC,CAAA,CAAC;AAZW,QAAA,eAAe,mBAY1B","sourcesContent":["import {\n  CognitoIdentityProviderClient,\n  VerifyUserAttributeCommand,\n  VerifyUserAttributeCommandInput,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\n\n/** Confirms the email attribute with the verification code sent to the user. */\nexport const verifyUserEmail = async (region: string, accessToken: string, verificationCode: string): Promise<void> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params: VerifyUserAttributeCommandInput = {\n    AccessToken: accessToken,\n    AttributeName: 'email',\n    Code: verificationCode,\n  };\n\n  await cognitoClient.send(new VerifyUserAttributeCommand(params));\n};\n"]}

package/lib/commonjs/logic/createAwsClient.d.ts

@@ -1,3 +1,6 @@
-type ClientConstructor<T> = new (args: any) => T;
-export declare function createAwsClient<T>(ClientClass: ClientConstructor<T>, args: any): T;
-export {};
+/**
+ * Returns a cached AWS SDK v3 client for the given class and config, creating it on first
+ * use. The client's `send` is wrapped so failed calls log the client, config, and command
+ * before rethrowing (CloudWatch visibility for which AWS call failed and why).
+ */
+export declare function createAwsClient<TClient>(ClientClass: new (args: any) => TClient, args: object): TClient;

package/lib/commonjs/logic/createAwsClient.js

@@ -10,20 +10,23 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createAwsClient = createAwsClient;
+// One client instance per (client class, config) pair, reused across invocations in a
+// warm lambda container so connection pools and SDK middleware are not rebuilt per call.
 const cache = new WeakMap();
+/**
+ * Returns a cached AWS SDK v3 client for the given class and config, creating it on first
+ * use. The client's `send` is wrapped so failed calls log the client, config, and command
+ * before rethrowing (CloudWatch visibility for which AWS call failed and why).
+ */
 function createAwsClient(ClientClass, args) {
-    // Get or create the Map for the ClientClass
     let argsCache = cache.get(ClientClass);
     if (!argsCache) {
         argsCache = new Map();
         cache.set(ClientClass, argsCache);
     }
-    // Generate a key for the arguments
     const argsKey = JSON.stringify(args);
-    // Check if the instance already exists in the cache
     if (!argsCache.has(argsKey)) {
         const newClient = new ClientClass(args);
-        // If the send method exists, wrap it with error handling so we can see it in the logs
         if (typeof newClient.send === 'function') {
             const originalSend = newClient.send;
             newClient.send = function (...sendArgs) {
@@ -38,10 +41,8 @@ function createAwsClient(ClientClass, args) {
                 });
             };
         }
-        // Create a new instance and store it in the cache
         argsCache.set(argsKey, newClient);
     }
-    // Return the cached instance
     return argsCache.get(argsKey);
 }
 //# sourceMappingURL=createAwsClient.js.map