quidproquo-actionprocessor-awslambda 0.1.10 → 0.1.12

package/lib/commonjs/logic/cache/memoFuncAsync.js.map

@@ -1 +1 @@
-{"version":3,"file":"memoFuncAsync.js","sourceRoot":"","sources":["../../../../src/logic/cache/memoFuncAsync.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,4DAAmC;AAEnC,MAAM,KAAK,GAAG,IAAI,OAAO,EAAqB,CAAC;AAE/C;;;;;GAKG;AACI,MAAM,aAAa,GAAG,CAAoC,IAAO,EAAE,eAAuB,IAAI,EAAK,EAAE;IAC1G,OAAO,CAAC,CAAO,GAAG,IAAW,EAAE,EAAE;QAC/B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,oBAAS,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;QAEnC,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC,GAAG,CAAI,QAAQ,CAAC,CAAC;QACpC,CAAC;QAED,mBAAmB;QACnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QAEnC,oBAAoB;QACpB,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAEhC,OAAO,MAAM,CAAC;IAChB,CAAC,CAAA,CAAiB,CAAC;AACrB,CAAC,CAAC;AArBW,QAAA,aAAa,iBAqBxB","sourcesContent":["import NodeCache from 'node-cache';\n\nconst cache = new WeakMap<object, NodeCache>();\n\n/**\n * Memoizes a function by caching its return values.\n * @param func The function to memoize.\n * @param ttlInSeconds Time-to-live for the cached values in seconds.\n * @returns The memoized function.\n */\nexport const memoFuncAsync = <T extends (...args: any[]) => any>(func: T, ttlInSeconds: number = 3600): T => {\n  return (async (...args: any[]) => {\n    if (!cache.has(func)) {\n      cache.set(func, new NodeCache({ stdTTL: ttlInSeconds }));\n    }\n\n    const cacheKey = JSON.stringify(args);\n    const nodeCache = cache.get(func)!;\n\n    if (nodeCache.has(cacheKey)) {\n      return nodeCache.get<T>(cacheKey);\n    }\n\n    // Await the result\n    const result = await func(...args);\n\n    // and then cache it\n    nodeCache.set(cacheKey, result);\n\n    return result;\n  }) as unknown as T;\n};\n"]}
+{"version":3,"file":"memoFuncAsync.js","sourceRoot":"","sources":["../../../../src/logic/cache/memoFuncAsync.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,4DAAmC;AAKnC,2EAA2E;AAC3E,MAAM,KAAK,GAAG,IAAI,OAAO,EAAsB,CAAC;AAEhD;;;;;;GAMG;AACI,MAAM,aAAa,GAAG,CAAoB,IAAO,EAAE,eAAuB,IAAI,EAAK,EAAE;IAC1F,OAAO,CAAC,CAAO,GAAG,IAAmB,EAAE,EAAE;QACvC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,oBAAS,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;QAEnC,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC,GAAG,CAAyB,QAAQ,CAAC,CAAC;QACzD,CAAC;QAED,0DAA0D;QAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACnC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAEhC,OAAO,MAAM,CAAC;IAChB,CAAC,CAAA,CAAiB,CAAC;AACrB,CAAC,CAAC;AAnBW,QAAA,aAAa,iBAmBxB","sourcesContent":["import NodeCache from 'node-cache';\n\n// `any` is the variance boundary that lets one signature wrap functions of any arity.\ntype AnyFunc = (...args: any[]) => any;\n\n// Keyed per wrapped function so each memoized function gets its own cache.\nconst cache = new WeakMap<AnyFunc, NodeCache>();\n\n/**\n * Memoizes an async function by its JSON-stringified arguments, caching the RESOLVED\n * value (falsy values included). A rejected promise is not cached, so failures retry.\n * @param func The function to memoize.\n * @param ttlInSeconds Time-to-live for the cached values in seconds.\n * @returns The memoized function.\n */\nexport const memoFuncAsync = <T extends AnyFunc>(func: T, ttlInSeconds: number = 3600): T => {\n  return (async (...args: Parameters<T>) => {\n    if (!cache.has(func)) {\n      cache.set(func, new NodeCache({ stdTTL: ttlInSeconds }));\n    }\n\n    const cacheKey = JSON.stringify(args);\n    const nodeCache = cache.get(func)!;\n\n    if (nodeCache.has(cacheKey)) {\n      return nodeCache.get<Awaited<ReturnType<T>>>(cacheKey);\n    }\n\n    // Await before caching so only resolved values are stored\n    const result = await func(...args);\n    nodeCache.set(cacheKey, result);\n\n    return result;\n  }) as unknown as T;\n};\n"]}

package/lib/commonjs/logic/cloudFront/invalidateCache.d.ts

@@ -1,2 +1 @@
-export declare const getInvalidationCallerReference: (paths: string[]) => string;
 export declare const invalidateCache: (distributionId: string, region: string, paths: string[]) => Promise<void>;

package/lib/commonjs/logic/cloudFront/invalidateCache.js

@@ -12,31 +12,28 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.invalidateCache = exports.getInvalidationCallerReference = void 0;
+exports.invalidateCache = void 0;
 const crypto_1 = __importDefault(require("crypto"));
 const client_cloudfront_1 = require("@aws-sdk/client-cloudfront");
 const createAwsClient_1 = require("../createAwsClient");
+// CloudFront dedupes CreateInvalidation calls by CallerReference, so it must be unique
+// per request: hash of the paths plus the current time.
 const getInvalidationCallerReference = (paths) => {
-    const allPaths = paths.join('');
-    // All paths as a hash
-    const allPathHash = crypto_1.default.createHash('md5').update(allPaths).digest('hex');
-    // Unique key is the now time with all paths hash
+    const allPathHash = crypto_1.default.createHash('md5').update(paths.join('')).digest('hex');
     return allPathHash + new Date().toISOString();
 };
-exports.getInvalidationCallerReference = getInvalidationCallerReference;
 const invalidateCache = (distributionId, region, paths) => __awaiter(void 0, void 0, void 0, function* () {
     const cloudFrontClient = (0, createAwsClient_1.createAwsClient)(client_cloudfront_1.CloudFrontClient, { region });
-    const input = {
+    yield cloudFrontClient.send(new client_cloudfront_1.CreateInvalidationCommand({
         DistributionId: distributionId,
         InvalidationBatch: {
             Paths: {
                 Quantity: paths.length,
                 Items: paths,
             },
-            CallerReference: (0, exports.getInvalidationCallerReference)(paths),
+            CallerReference: getInvalidationCallerReference(paths),
         },
-    };
-    yield cloudFrontClient.send(new client_cloudfront_1.CreateInvalidationCommand(input));
+    }));
 });
 exports.invalidateCache = invalidateCache;
 //# sourceMappingURL=invalidateCache.js.map

package/lib/commonjs/logic/cloudFront/invalidateCache.js.map

@@ -1 +1 @@
-{"version":3,"file":"invalidateCache.js","sourceRoot":"","sources":["../../../../src/logic/cloudFront/invalidateCache.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,oDAA4B;AAC5B,kEAAyH;AAEzH,wDAAqD;AAE9C,MAAM,8BAA8B,GAAG,CAAC,KAAe,EAAU,EAAE;IACxE,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEhC,sBAAsB;IACtB,MAAM,WAAW,GAAG,gBAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE5E,iDAAiD;IACjD,OAAO,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAChD,CAAC,CAAC;AARW,QAAA,8BAA8B,kCAQzC;AAEK,MAAM,eAAe,GAAG,CAAO,cAAsB,EAAE,MAAc,EAAE,KAAe,EAAiB,EAAE;IAC9G,MAAM,gBAAgB,GAAG,IAAA,iCAAe,EAAC,oCAAgB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAEvE,MAAM,KAAK,GAAmC;QAC5C,cAAc,EAAE,cAAc;QAC9B,iBAAiB,EAAE;YACjB,KAAK,EAAE;gBACL,QAAQ,EAAE,KAAK,CAAC,MAAM;gBACtB,KAAK,EAAE,KAAK;aACb;YACD,eAAe,EAAE,IAAA,sCAA8B,EAAC,KAAK,CAAC;SACvD;KACF,CAAC;IAEF,MAAM,gBAAgB,CAAC,IAAI,CAAC,IAAI,6CAAyB,CAAC,KAAK,CAAC,CAAC,CAAC;AACpE,CAAC,CAAA,CAAC;AAfW,QAAA,eAAe,mBAe1B","sourcesContent":["import crypto from 'crypto';\nimport { CloudFrontClient, CreateInvalidationCommand, CreateInvalidationCommandInput } from '@aws-sdk/client-cloudfront';\n\nimport { createAwsClient } from '../createAwsClient';\n\nexport const getInvalidationCallerReference = (paths: string[]): string => {\n  const allPaths = paths.join('');\n\n  // All paths as a hash\n  const allPathHash = crypto.createHash('md5').update(allPaths).digest('hex');\n\n  // Unique key is the now time with all paths hash\n  return allPathHash + new Date().toISOString();\n};\n\nexport const invalidateCache = async (distributionId: string, region: string, paths: string[]): Promise<void> => {\n  const cloudFrontClient = createAwsClient(CloudFrontClient, { region });\n\n  const input: CreateInvalidationCommandInput = {\n    DistributionId: distributionId,\n    InvalidationBatch: {\n      Paths: {\n        Quantity: paths.length,\n        Items: paths,\n      },\n      CallerReference: getInvalidationCallerReference(paths),\n    },\n  };\n\n  await cloudFrontClient.send(new CreateInvalidationCommand(input));\n};\n"]}
+{"version":3,"file":"invalidateCache.js","sourceRoot":"","sources":["../../../../src/logic/cloudFront/invalidateCache.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,oDAA4B;AAC5B,kEAAyF;AAEzF,wDAAqD;AAErD,uFAAuF;AACvF,wDAAwD;AACxD,MAAM,8BAA8B,GAAG,CAAC,KAAe,EAAU,EAAE;IACjE,MAAM,WAAW,GAAG,gBAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAElF,OAAO,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAChD,CAAC,CAAC;AAEK,MAAM,eAAe,GAAG,CAAO,cAAsB,EAAE,MAAc,EAAE,KAAe,EAAiB,EAAE;IAC9G,MAAM,gBAAgB,GAAG,IAAA,iCAAe,EAAC,oCAAgB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAEvE,MAAM,gBAAgB,CAAC,IAAI,CACzB,IAAI,6CAAyB,CAAC;QAC5B,cAAc,EAAE,cAAc;QAC9B,iBAAiB,EAAE;YACjB,KAAK,EAAE;gBACL,QAAQ,EAAE,KAAK,CAAC,MAAM;gBACtB,KAAK,EAAE,KAAK;aACb;YACD,eAAe,EAAE,8BAA8B,CAAC,KAAK,CAAC;SACvD;KACF,CAAC,CACH,CAAC;AACJ,CAAC,CAAA,CAAC;AAfW,QAAA,eAAe,mBAe1B","sourcesContent":["import crypto from 'crypto';\nimport { CloudFrontClient, CreateInvalidationCommand } from '@aws-sdk/client-cloudfront';\n\nimport { createAwsClient } from '../createAwsClient';\n\n// CloudFront dedupes CreateInvalidation calls by CallerReference, so it must be unique\n// per request: hash of the paths plus the current time.\nconst getInvalidationCallerReference = (paths: string[]): string => {\n  const allPathHash = crypto.createHash('md5').update(paths.join('')).digest('hex');\n\n  return allPathHash + new Date().toISOString();\n};\n\nexport const invalidateCache = async (distributionId: string, region: string, paths: string[]): Promise<void> => {\n  const cloudFrontClient = createAwsClient(CloudFrontClient, { region });\n\n  await cloudFrontClient.send(\n    new CreateInvalidationCommand({\n      DistributionId: distributionId,\n      InvalidationBatch: {\n        Paths: {\n          Quantity: paths.length,\n          Items: paths,\n        },\n        CallerReference: getInvalidationCallerReference(paths),\n      },\n    }),\n  );\n};\n"]}

package/lib/commonjs/logic/cloudformation/getExportedValue.d.ts

@@ -1 +1,5 @@
+/**
+ * Resolves a CloudFormation export by name, paging through ListExports. Memoized
+ * (1 hour) because exports are deploy-time constants; throws if the export does not exist.
+ */
 export declare const getExportedValue: (variableName: string, region: string) => Promise<string>;

package/lib/commonjs/logic/cloudformation/getExportedValue.js

@@ -13,6 +13,10 @@ exports.getExportedValue = void 0;
 const client_cloudformation_1 = require("@aws-sdk/client-cloudformation");
 const memoFuncAsync_1 = require("../cache/memoFuncAsync");
 const createAwsClient_1 = require("../createAwsClient");
+/**
+ * Resolves a CloudFormation export by name, paging through ListExports. Memoized
+ * (1 hour) because exports are deploy-time constants; throws if the export does not exist.
+ */
 exports.getExportedValue = (0, memoFuncAsync_1.memoFuncAsync)((variableName, region) => __awaiter(void 0, void 0, void 0, function* () {
     var _a;
     const cloudformation = (0, createAwsClient_1.createAwsClient)(client_cloudformation_1.CloudFormationClient, { region });

package/lib/commonjs/logic/cloudformation/getExportedValue.js.map

@@ -1 +1 @@
-{"version":3,"file":"getExportedValue.js","sourceRoot":"","sources":["../../../../src/logic/cloudformation/getExportedValue.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,0EAAmH;AAEnH,0DAAuD;AACvD,wDAAqD;AAExC,QAAA,gBAAgB,GAAG,IAAA,6BAAa,EAAC,CAAO,YAAoB,EAAE,MAAc,EAAmB,EAAE;;IAC5G,MAAM,cAAc,GAAG,IAAA,iCAAe,EAAC,4CAAoB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAEzE,MAAM,iBAAiB,GAA4B,EAAE,CAAC;IAEtD,GAAG,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,0CAAkB,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAEpF,MAAM,KAAK,GAAG,MAAA,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,0CAAE,KAAK,CAAC;QACjF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,cAAc,YAAY,QAAQ,KAAK,GAAG,CAAC,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,iBAAiB,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACjD,CAAC,QAAQ,iBAAiB,CAAC,SAAS,EAAE;IAEtC,MAAM,IAAI,KAAK,CAAC,uBAAuB,YAAY,GAAG,CAAC,CAAC;AAC1D,CAAC,CAAA,CAAC,CAAC","sourcesContent":["import { CloudFormationClient, ListExportsCommand, ListExportsCommandInput } from '@aws-sdk/client-cloudformation';\n\nimport { memoFuncAsync } from '../cache/memoFuncAsync';\nimport { createAwsClient } from '../createAwsClient';\n\nexport const getExportedValue = memoFuncAsync(async (variableName: string, region: string): Promise<string> => {\n  const cloudformation = createAwsClient(CloudFormationClient, { region });\n\n  const listCommandParams: ListExportsCommandInput = {};\n\n  do {\n    const result = await cloudformation.send(new ListExportsCommand(listCommandParams));\n\n    const value = (result.Exports || []).find((e) => e.Name === variableName)?.Value;\n    if (value !== undefined) {\n      console.log(`CF Found: [${variableName}] = [${value}]`);\n      return value;\n    }\n\n    listCommandParams.NextToken = result.NextToken;\n  } while (listCommandParams.NextToken);\n\n  throw new Error(`CF could not find: [${variableName}]`);\n});\n"]}
+{"version":3,"file":"getExportedValue.js","sourceRoot":"","sources":["../../../../src/logic/cloudformation/getExportedValue.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,0EAAmH;AAEnH,0DAAuD;AACvD,wDAAqD;AAErD;;;GAGG;AACU,QAAA,gBAAgB,GAAG,IAAA,6BAAa,EAAC,CAAO,YAAoB,EAAE,MAAc,EAAmB,EAAE;;IAC5G,MAAM,cAAc,GAAG,IAAA,iCAAe,EAAC,4CAAoB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAEzE,MAAM,iBAAiB,GAA4B,EAAE,CAAC;IAEtD,GAAG,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,0CAAkB,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAEpF,MAAM,KAAK,GAAG,MAAA,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,0CAAE,KAAK,CAAC;QACjF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,cAAc,YAAY,QAAQ,KAAK,GAAG,CAAC,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,iBAAiB,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACjD,CAAC,QAAQ,iBAAiB,CAAC,SAAS,EAAE;IAEtC,MAAM,IAAI,KAAK,CAAC,uBAAuB,YAAY,GAAG,CAAC,CAAC;AAC1D,CAAC,CAAA,CAAC,CAAC","sourcesContent":["import { CloudFormationClient, ListExportsCommand, ListExportsCommandInput } from '@aws-sdk/client-cloudformation';\n\nimport { memoFuncAsync } from '../cache/memoFuncAsync';\nimport { createAwsClient } from '../createAwsClient';\n\n/**\n * Resolves a CloudFormation export by name, paging through ListExports. Memoized\n * (1 hour) because exports are deploy-time constants; throws if the export does not exist.\n */\nexport const getExportedValue = memoFuncAsync(async (variableName: string, region: string): Promise<string> => {\n  const cloudformation = createAwsClient(CloudFormationClient, { region });\n\n  const listCommandParams: ListExportsCommandInput = {};\n\n  do {\n    const result = await cloudformation.send(new ListExportsCommand(listCommandParams));\n\n    const value = (result.Exports || []).find((e) => e.Name === variableName)?.Value;\n    if (value !== undefined) {\n      console.log(`CF Found: [${variableName}] = [${value}]`);\n      return value;\n    }\n\n    listCommandParams.NextToken = result.NextToken;\n  } while (listCommandParams.NextToken);\n\n  throw new Error(`CF could not find: [${variableName}]`);\n});\n"]}

package/lib/commonjs/logic/cognito/authenticateUser.d.ts

@@ -1,2 +1,6 @@
 import { AuthenticateUserResponse } from 'quidproquo-core';
+/**
+ * Starts a Cognito auth flow (password auth, or CUSTOM_AUTH when isCustom) and
+ * returns the qpq response: either issued tokens or a pending challenge.
+ */
 export declare const authenticateUser: (userPoolId: string, clientId: string, region: string, isCustom: boolean, username: string, password?: string) => Promise<AuthenticateUserResponse>;

package/lib/commonjs/logic/cognito/authenticateUser.js

@@ -13,16 +13,21 @@ exports.authenticateUser = void 0;
 const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
 const createAwsClient_1 = require("../createAwsClient");
 const calculateSecretHash_1 = require("./utils/calculateSecretHash");
-const transformCognitoResponse_1 = require("./utils/transformCognitoResponse");
+const cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo_1 = require("./utils/cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo");
 const getUserPoolClientSecret_1 = require("./getUserPoolClientSecret");
 // TODO: retry for TooManyRequestsException
+/**
+ * Starts a Cognito auth flow (password auth, or CUSTOM_AUTH when isCustom) and
+ * returns the qpq response: either issued tokens or a pending challenge.
+ */
 const authenticateUser = (userPoolId, clientId, region, isCustom, username, password) => __awaiter(void 0, void 0, void 0, function* () {
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
         region,
     });
     const clientSecret = yield (0, getUserPoolClientSecret_1.getUserPoolClientSecret)(userPoolId, clientId, region);
     const secretHash = (0, calculateSecretHash_1.calculateSecretHash)(username, clientId, clientSecret);
-    // Time we issued the request
+    // Token expiry is computed relative to this; captured before the call so the
+    // derived expiresAt errs early rather than late.
     const issueDateTime = new Date().toISOString();
     const params = {
         AuthFlow: isCustom ? client_cognito_identity_provider_1.AuthFlowType.CUSTOM_AUTH : client_cognito_identity_provider_1.AuthFlowType.ADMIN_USER_PASSWORD_AUTH,
@@ -37,7 +42,7 @@ const authenticateUser = (userPoolId, clientId, region, isCustom, username, pass
         params.AuthParameters.PASSWORD = password;
     }
     const response = yield cognitoClient.send(new client_cognito_identity_provider_1.AdminInitiateAuthCommand(params));
-    return (0, transformCognitoResponse_1.cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo)(response, issueDateTime);
+    return (0, cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo_1.cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo)(response, issueDateTime);
 });
 exports.authenticateUser = authenticateUser;
 //# sourceMappingURL=authenticateUser.js.map

package/lib/commonjs/logic/cognito/authenticateUser.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticateUser.js","sourceRoot":"","sources":["../../../../src/logic/cognito/authenticateUser.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAKmD;AAEnD,wDAAqD;AACrD,qEAAkE;AAClE,+EAA2G;AAC3G,uEAAoE;AAEpE,2CAA2C;AAEpC,MAAM,gBAAgB,GAAG,CAC9B,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,QAAiB,EACjB,QAAgB,EAChB,QAAiB,EACkB,EAAE;IACrC,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,IAAA,iDAAuB,EAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,IAAA,yCAAmB,EAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,6BAA6B;IAC7B,MAAM,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE/C,MAAM,MAAM,GAAkC;QAC5C,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,+CAAY,CAAC,WAAW,CAAC,CAAC,CAAC,+CAAY,CAAC,wBAAwB;QACrF,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAElB,cAAc,EAAE;YACd,QAAQ,EAAE,QAAQ;YAClB,WAAW,EAAE,UAAU;SACxB;KACF,CAAC;IAEF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,cAAe,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC7C,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,2DAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhF,OAAO,IAAA,kFAAuD,EAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AAC1F,CAAC,CAAA,CAAC;AApCW,QAAA,gBAAgB,oBAoC3B","sourcesContent":["import { AuthenticateUserChallenge, AuthenticateUserResponse, UserDirectoryAuthenticateUserActionPayload } from 'quidproquo-core';\n\nimport {\n  AdminInitiateAuthCommand,\n  AdminInitiateAuthCommandInput,\n  AuthFlowType,\n  CognitoIdentityProviderClient,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo } from './utils/transformCognitoResponse';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\n// TODO: retry for TooManyRequestsException\n\nexport const authenticateUser = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  isCustom: boolean,\n  username: string,\n  password?: string,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  // Time we issued the request\n  const issueDateTime = new Date().toISOString();\n\n  const params: AdminInitiateAuthCommandInput = {\n    AuthFlow: isCustom ? AuthFlowType.CUSTOM_AUTH : AuthFlowType.ADMIN_USER_PASSWORD_AUTH,\n    UserPoolId: userPoolId,\n    ClientId: clientId,\n\n    AuthParameters: {\n      USERNAME: username,\n      SECRET_HASH: secretHash,\n    },\n  };\n\n  if (password) {\n    params.AuthParameters!.PASSWORD = password;\n  }\n\n  const response = await cognitoClient.send(new AdminInitiateAuthCommand(params));\n\n  return cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo(response, issueDateTime);\n};\n"]}
+{"version":3,"file":"authenticateUser.js","sourceRoot":"","sources":["../../../../src/logic/cognito/authenticateUser.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAKmD;AAEnD,wDAAqD;AACrD,qEAAkE;AAClE,6IAA0I;AAC1I,uEAAoE;AAEpE,2CAA2C;AAE3C;;;GAGG;AACI,MAAM,gBAAgB,GAAG,CAC9B,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,QAAiB,EACjB,QAAgB,EAChB,QAAiB,EACkB,EAAE;IACrC,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,IAAA,iDAAuB,EAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,IAAA,yCAAmB,EAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,6EAA6E;IAC7E,iDAAiD;IACjD,MAAM,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE/C,MAAM,MAAM,GAAkC;QAC5C,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,+CAAY,CAAC,WAAW,CAAC,CAAC,CAAC,+CAAY,CAAC,wBAAwB;QACrF,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAElB,cAAc,EAAE;YACd,QAAQ,EAAE,QAAQ;YAClB,WAAW,EAAE,UAAU;SACxB;KACF,CAAC;IAEF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,cAAe,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC7C,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,2DAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhF,OAAO,IAAA,iHAAuD,EAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AAC1F,CAAC,CAAA,CAAC;AArCW,QAAA,gBAAgB,oBAqC3B","sourcesContent":["import { AuthenticateUserResponse } from 'quidproquo-core';\n\nimport {\n  AdminInitiateAuthCommand,\n  AdminInitiateAuthCommandInput,\n  AuthFlowType,\n  CognitoIdentityProviderClient,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo } from './utils/cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\n// TODO: retry for TooManyRequestsException\n\n/**\n * Starts a Cognito auth flow (password auth, or CUSTOM_AUTH when isCustom) and\n * returns the qpq response: either issued tokens or a pending challenge.\n */\nexport const authenticateUser = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  isCustom: boolean,\n  username: string,\n  password?: string,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  // Token expiry is computed relative to this; captured before the call so the\n  // derived expiresAt errs early rather than late.\n  const issueDateTime = new Date().toISOString();\n\n  const params: AdminInitiateAuthCommandInput = {\n    AuthFlow: isCustom ? AuthFlowType.CUSTOM_AUTH : AuthFlowType.ADMIN_USER_PASSWORD_AUTH,\n    UserPoolId: userPoolId,\n    ClientId: clientId,\n\n    AuthParameters: {\n      USERNAME: username,\n      SECRET_HASH: secretHash,\n    },\n  };\n\n  if (password) {\n    params.AuthParameters!.PASSWORD = password;\n  }\n\n  const response = await cognitoClient.send(new AdminInitiateAuthCommand(params));\n\n  return cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo(response, issueDateTime);\n};\n"]}

package/lib/commonjs/logic/cognito/cognitoAttributeMap.d.ts

@@ -1,11 +1,3 @@
 import { UserAttributes } from 'quidproquo-core';
+/** Maps qpq UserAttributes keys to their Cognito standard attribute names. */
 export declare const cognitoAttributeMap: Record<keyof UserAttributes, string>;
-export declare const getCognitoUserAttributesFromQpqUserAttributes: (userAttributes: UserAttributes) => {
-    Name: string;
-    Value: string;
-}[];
-export declare const getQpqAttributesFromCognitoUserAttributes: (cognitoUserAttributes: {
-    Name: string;
-    Value: string;
-}[]) => UserAttributes;
-export declare const getQpqAttributesFromCognitoStringMap: (cognitoUserAttributes: Record<string, string>) => UserAttributes;

package/lib/commonjs/logic/cognito/cognitoAttributeMap.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getQpqAttributesFromCognitoStringMap = exports.getQpqAttributesFromCognitoUserAttributes = exports.getCognitoUserAttributesFromQpqUserAttributes = exports.cognitoAttributeMap = void 0;
+exports.cognitoAttributeMap = void 0;
+/** Maps qpq UserAttributes keys to their Cognito standard attribute names. */
 exports.cognitoAttributeMap = {
     email: 'email',
     emailVerified: 'email_verified',
@@ -21,39 +22,4 @@ exports.cognitoAttributeMap = {
     website: 'website',
     zoneInfo: 'zoneinfo',
 };
-// Flip the cognitoAttributeMap for reverse mapping
-const reversedCognitoAttributeMap = Object.entries(exports.cognitoAttributeMap).reduce((acc, [key, value]) => (Object.assign(Object.assign({}, acc), { [value]: key })), {});
-const getCognitoUserAttributesFromQpqUserAttributes = (userAttributes) => {
-    return Object.keys(userAttributes)
-        .map((key) => ({
-        Name: exports.cognitoAttributeMap[key],
-        Value: `${userAttributes[key]}`,
-    }))
-        .filter((attribute) => !!attribute.Name && !!attribute.Value);
-};
-exports.getCognitoUserAttributesFromQpqUserAttributes = getCognitoUserAttributesFromQpqUserAttributes;
-const getQpqAttributeObjectFromCognitoKeyValue = (key, value) => {
-    const userAttributeKey = reversedCognitoAttributeMap[key];
-    if (!userAttributeKey) {
-        return {}; // If there's no matching key in your mapping, just return nothing
-    }
-    if (userAttributeKey === 'emailVerified') {
-        // Assume the value of 'email_verified' is a string of 'true' or 'false'
-        return { [userAttributeKey]: value === 'true' };
-    }
-    return { [userAttributeKey]: value };
-};
-const getQpqAttributesFromCognitoUserAttributes = (cognitoUserAttributes) => {
-    // Map cognitoUserAttributes to your UserAttributes format
-    const userAttributes = cognitoUserAttributes.reduce((acc, { Name, Value }) => {
-        return Object.assign(Object.assign({}, acc), getQpqAttributeObjectFromCognitoKeyValue(Name, Value));
-    }, {});
-    return userAttributes;
-};
-exports.getQpqAttributesFromCognitoUserAttributes = getQpqAttributesFromCognitoUserAttributes;
-const getQpqAttributesFromCognitoStringMap = (cognitoUserAttributes) => {
-    const userAttributes = Object.keys(cognitoUserAttributes).reduce((acc, key) => (Object.assign(Object.assign({}, acc), getQpqAttributeObjectFromCognitoKeyValue(key, cognitoUserAttributes[key]))), {});
-    return userAttributes;
-};
-exports.getQpqAttributesFromCognitoStringMap = getQpqAttributesFromCognitoStringMap;
 //# sourceMappingURL=cognitoAttributeMap.js.map

package/lib/commonjs/logic/cognito/cognitoAttributeMap.js.map

@@ -1 +1 @@
-{"version":3,"file":"cognitoAttributeMap.js","sourceRoot":"","sources":["../../../../src/logic/cognito/cognitoAttributeMap.ts"],"names":[],"mappings":";;;AAEa,QAAA,mBAAmB,GAAyC;IACvE,KAAK,EAAE,OAAO;IACd,aAAa,EAAE,gBAAgB;IAC/B,MAAM,EAAE,KAAK;IAEb,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,WAAW;IACtB,UAAU,EAAE,aAAa;IACzB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,YAAY;IACvB,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,aAAa;IACzB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,WAAW,EAAE,cAAc;IAC3B,OAAO,EAAE,SAAS;IAClB,iBAAiB,EAAE,oBAAoB;IACvC,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;CACrB,CAAC;AAEF,mDAAmD;AACnD,MAAM,2BAA2B,GAAyC,MAAM,CAAC,OAAO,CAAC,2BAAmB,CAAC,CAAC,MAAM,CAClH,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,iCAAM,GAAG,KAAE,CAAC,KAAK,CAAC,EAAE,GAAG,IAAG,EACjD,EAAE,CACH,CAAC;AAEK,MAAM,6CAA6C,GAAG,CAAC,cAA8B,EAAE,EAAE;IAC9F,OAAO,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC;SAC/B,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACb,IAAI,EAAE,2BAAmB,CAAC,GAA2B,CAAC;QACtD,KAAK,EAAE,GAAG,cAAc,CAAC,GAA2B,CAAC,EAAE;KACxD,CAAC,CAAC;SACF,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC,CAAC;AAPW,QAAA,6CAA6C,iDAOxD;AAEF,MAAM,wCAAwC,GAAG,CAAC,GAAW,EAAE,KAAa,EAAkB,EAAE;IAC9F,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAE1D,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC,CAAC,kEAAkE;IAC/E,CAAC;IAED,IAAI,gBAAgB,KAAK,eAAe,EAAE,CAAC;QACzC,wEAAwE;QACxE,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE,KAAK,KAAK,MAAM,EAAE,CAAC;IAClD,CAAC;IAED,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC;AACvC,CAAC,CAAC;AAEK,MAAM,yCAAyC,GAAG,CAAC,qBAAwD,EAAkB,EAAE;IACpI,0DAA0D;IAC1D,MAAM,cAAc,GAAmB,qBAAqB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QAC3F,uCACK,GAAG,GACH,wCAAwC,CAAC,IAAI,EAAE,KAAK,CAAC,EACxD;IACJ,CAAC,EAAE,EAAoB,CAAC,CAAC;IAEzB,OAAO,cAAc,CAAC;AACxB,CAAC,CAAC;AAVW,QAAA,yCAAyC,6CAUpD;AAEK,MAAM,oCAAoC,GAAG,CAAC,qBAA6C,EAAkB,EAAE;IACpH,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAC9D,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,iCACT,GAAG,GACH,wCAAwC,CAAC,GAAG,EAAE,qBAAqB,CAAC,GAAG,CAAC,CAAC,EAC5E,EACF,EAAoB,CACrB,CAAC;IAEF,OAAO,cAAc,CAAC;AACxB,CAAC,CAAC;AAVW,QAAA,oCAAoC,wCAU/C","sourcesContent":["import { CreateUserRequest, UserAttributes } from 'quidproquo-core';\n\nexport const cognitoAttributeMap: Record<keyof UserAttributes, string> = {\n  email: 'email',\n  emailVerified: 'email_verified',\n  userId: 'sub',\n\n  address: 'address',\n  birthDate: 'birthdate',\n  familyName: 'family_name',\n  gender: 'gender',\n  givenName: 'given_name',\n  locale: 'locale',\n  middleName: 'middle_name',\n  name: 'name',\n  nickname: 'nickname',\n  phoneNumber: 'phone_number',\n  picture: 'picture',\n  preferredUsername: 'preferred_username',\n  profile: 'profile',\n  website: 'website',\n  zoneInfo: 'zoneinfo',\n};\n\n// Flip the cognitoAttributeMap for reverse mapping\nconst reversedCognitoAttributeMap: Record<string, keyof UserAttributes> = Object.entries(cognitoAttributeMap).reduce(\n  (acc, [key, value]) => ({ ...acc, [value]: key }),\n  {},\n);\n\nexport const getCognitoUserAttributesFromQpqUserAttributes = (userAttributes: UserAttributes) => {\n  return Object.keys(userAttributes)\n    .map((key) => ({\n      Name: cognitoAttributeMap[key as keyof UserAttributes],\n      Value: `${userAttributes[key as keyof UserAttributes]}`,\n    }))\n    .filter((attribute) => !!attribute.Name && !!attribute.Value);\n};\n\nconst getQpqAttributeObjectFromCognitoKeyValue = (key: string, value: string): UserAttributes => {\n  const userAttributeKey = reversedCognitoAttributeMap[key];\n\n  if (!userAttributeKey) {\n    return {}; // If there's no matching key in your mapping, just return nothing\n  }\n\n  if (userAttributeKey === 'emailVerified') {\n    // Assume the value of 'email_verified' is a string of 'true' or 'false'\n    return { [userAttributeKey]: value === 'true' };\n  }\n\n  return { [userAttributeKey]: value };\n};\n\nexport const getQpqAttributesFromCognitoUserAttributes = (cognitoUserAttributes: { Name: string; Value: string }[]): UserAttributes => {\n  // Map cognitoUserAttributes to your UserAttributes format\n  const userAttributes: UserAttributes = cognitoUserAttributes.reduce((acc, { Name, Value }) => {\n    return {\n      ...acc,\n      ...getQpqAttributeObjectFromCognitoKeyValue(Name, Value),\n    };\n  }, {} as UserAttributes);\n\n  return userAttributes;\n};\n\nexport const getQpqAttributesFromCognitoStringMap = (cognitoUserAttributes: Record<string, string>): UserAttributes => {\n  const userAttributes = Object.keys(cognitoUserAttributes).reduce(\n    (acc, key) => ({\n      ...acc,\n      ...getQpqAttributeObjectFromCognitoKeyValue(key, cognitoUserAttributes[key]),\n    }),\n    {} as UserAttributes,\n  );\n\n  return userAttributes;\n};\n"]}
+{"version":3,"file":"cognitoAttributeMap.js","sourceRoot":"","sources":["../../../../src/logic/cognito/cognitoAttributeMap.ts"],"names":[],"mappings":";;;AAEA,8EAA8E;AACjE,QAAA,mBAAmB,GAAyC;IACvE,KAAK,EAAE,OAAO;IACd,aAAa,EAAE,gBAAgB;IAC/B,MAAM,EAAE,KAAK;IAEb,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,WAAW;IACtB,UAAU,EAAE,aAAa;IACzB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,YAAY;IACvB,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,aAAa;IACzB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,WAAW,EAAE,cAAc;IAC3B,OAAO,EAAE,SAAS;IAClB,iBAAiB,EAAE,oBAAoB;IACvC,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;CACrB,CAAC","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\n/** Maps qpq UserAttributes keys to their Cognito standard attribute names. */\nexport const cognitoAttributeMap: Record<keyof UserAttributes, string> = {\n  email: 'email',\n  emailVerified: 'email_verified',\n  userId: 'sub',\n\n  address: 'address',\n  birthDate: 'birthdate',\n  familyName: 'family_name',\n  gender: 'gender',\n  givenName: 'given_name',\n  locale: 'locale',\n  middleName: 'middle_name',\n  name: 'name',\n  nickname: 'nickname',\n  phoneNumber: 'phone_number',\n  picture: 'picture',\n  preferredUsername: 'preferred_username',\n  profile: 'profile',\n  website: 'website',\n  zoneInfo: 'zoneinfo',\n};\n"]}

package/lib/commonjs/logic/cognito/confirmForgotPassword.d.ts

@@ -1,2 +1,6 @@
 import { AuthenticateUserResponse } from 'quidproquo-core';
+/**
+ * Confirms a forgot-password reset with the emailed code and new password, then
+ * signs the user straight in with it.
+ */
 export declare const confirmForgotPassword: (userPoolId: string, clientId: string, region: string, code: string, username: string, password: string) => Promise<AuthenticateUserResponse>;

package/lib/commonjs/logic/cognito/confirmForgotPassword.js

@@ -15,6 +15,10 @@ const createAwsClient_1 = require("../createAwsClient");
 const calculateSecretHash_1 = require("./utils/calculateSecretHash");
 const authenticateUser_1 = require("./authenticateUser");
 const getUserPoolClientSecret_1 = require("./getUserPoolClientSecret");
+/**
+ * Confirms a forgot-password reset with the emailed code and new password, then
+ * signs the user straight in with it.
+ */
 const confirmForgotPassword = (userPoolId, clientId, region, code, username, password) => __awaiter(void 0, void 0, void 0, function* () {
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
         region,
@@ -29,9 +33,7 @@ const confirmForgotPassword = (userPoolId, clientId, region, code, username, pas
         Username: username,
     };
     yield cognitoClient.send(new client_cognito_identity_provider_1.ConfirmForgotPasswordCommand(params));
-    // Authenticate the user
-    const authResponse = yield (0, authenticateUser_1.authenticateUser)(userPoolId, clientId, region, false, username, password);
-    return authResponse;
+    return (0, authenticateUser_1.authenticateUser)(userPoolId, clientId, region, false, username, password);
 });
 exports.confirmForgotPassword = confirmForgotPassword;
 //# sourceMappingURL=confirmForgotPassword.js.map

package/lib/commonjs/logic/cognito/confirmForgotPassword.js.map

@@ -1 +1 @@
-{"version":3,"file":"confirmForgotPassword.js","sourceRoot":"","sources":["../../../../src/logic/cognito/confirmForgotPassword.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAImD;AAEnD,wDAAqD;AACrD,qEAAkE;AAClE,yDAAsD;AACtD,uEAAoE;AAE7D,MAAM,qBAAqB,GAAG,CACnC,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,IAAY,EACZ,QAAgB,EAChB,QAAgB,EACmB,EAAE;IACrC,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,IAAA,iDAAuB,EAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,IAAA,yCAAmB,EAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAsC;QAChD,QAAQ,EAAE,QAAQ;QAElB,gBAAgB,EAAE,IAAI;QACtB,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,QAAQ;KACnB,CAAC;IAEF,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,+DAA4B,CAAC,MAAM,CAAC,CAAC,CAAC;IAEnE,wBAAwB;IACxB,MAAM,YAAY,GAA6B,MAAM,IAAA,mCAAgB,EAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAE/H,OAAO,YAAY,CAAC;AACtB,CAAC,CAAA,CAAC;AA9BW,QAAA,qBAAqB,yBA8BhC","sourcesContent":["import { AuthenticateUserResponse } from 'quidproquo-core';\n\nimport {\n  CognitoIdentityProviderClient,\n  ConfirmForgotPasswordCommand,\n  ConfirmForgotPasswordCommandInput,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { authenticateUser } from './authenticateUser';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\nexport const confirmForgotPassword = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  code: string,\n  username: string,\n  password: string,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  const params: ConfirmForgotPasswordCommandInput = {\n    ClientId: clientId,\n\n    ConfirmationCode: code,\n    SecretHash: secretHash,\n    Password: password,\n    Username: username,\n  };\n\n  await cognitoClient.send(new ConfirmForgotPasswordCommand(params));\n\n  // Authenticate the user\n  const authResponse: AuthenticateUserResponse = await authenticateUser(userPoolId, clientId, region, false, username, password);\n\n  return authResponse;\n};\n"]}
+{"version":3,"file":"confirmForgotPassword.js","sourceRoot":"","sources":["../../../../src/logic/cognito/confirmForgotPassword.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAImD;AAEnD,wDAAqD;AACrD,qEAAkE;AAClE,yDAAsD;AACtD,uEAAoE;AAEpE;;;GAGG;AACI,MAAM,qBAAqB,GAAG,CACnC,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,IAAY,EACZ,QAAgB,EAChB,QAAgB,EACmB,EAAE;IACrC,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,IAAA,iDAAuB,EAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,IAAA,yCAAmB,EAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAsC;QAChD,QAAQ,EAAE,QAAQ;QAElB,gBAAgB,EAAE,IAAI;QACtB,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,QAAQ;KACnB,CAAC;IAEF,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,+DAA4B,CAAC,MAAM,CAAC,CAAC,CAAC;IAEnE,OAAO,IAAA,mCAAgB,EAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACnF,CAAC,CAAA,CAAC;AA3BW,QAAA,qBAAqB,yBA2BhC","sourcesContent":["import { AuthenticateUserResponse } from 'quidproquo-core';\n\nimport {\n  CognitoIdentityProviderClient,\n  ConfirmForgotPasswordCommand,\n  ConfirmForgotPasswordCommandInput,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { authenticateUser } from './authenticateUser';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\n/**\n * Confirms a forgot-password reset with the emailed code and new password, then\n * signs the user straight in with it.\n */\nexport const confirmForgotPassword = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  code: string,\n  username: string,\n  password: string,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  const params: ConfirmForgotPasswordCommandInput = {\n    ClientId: clientId,\n\n    ConfirmationCode: code,\n    SecretHash: secretHash,\n    Password: password,\n    Username: username,\n  };\n\n  await cognitoClient.send(new ConfirmForgotPasswordCommand(params));\n\n  return authenticateUser(userPoolId, clientId, region, false, username, password);\n};\n"]}

package/lib/commonjs/logic/cognito/createUser.d.ts

@@ -1,2 +1,6 @@
 import { AuthenticateUserResponse, CreateUserRequest } from 'quidproquo-core';
+/**
+ * Creates a Cognito user with the requested attributes, activates their password
+ * and signs them in, returning the authenticated session.
+ */
 export declare const createUser: (userPoolId: string, region: string, clientId: string, createUserRequest: CreateUserRequest) => Promise<AuthenticateUserResponse>;

package/lib/commonjs/logic/cognito/createUser.js

@@ -13,8 +13,12 @@ exports.createUser = void 0;
 const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
 const createAwsClient_1 = require("../createAwsClient");
 const authenticateUser_1 = require("./authenticateUser");
-const cognitoAttributeMap_1 = require("./cognitoAttributeMap");
+const getCognitoUserAttributesFromQpqUserAttributes_1 = require("./getCognitoUserAttributesFromQpqUserAttributes");
 const setUserPassword_1 = require("./setUserPassword");
+/**
+ * Creates a Cognito user with the requested attributes, activates their password
+ * and signs them in, returning the authenticated session.
+ */
 const createUser = (userPoolId, region, clientId, createUserRequest) => __awaiter(void 0, void 0, void 0, function* () {
     var _a;
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
@@ -25,7 +29,9 @@ const createUser = (userPoolId, region, clientId, createUserRequest) => __awaite
         Username: createUserRequest.email,
         MessageAction: client_cognito_identity_provider_1.MessageActionType.SUPPRESS, // Don't contact the user
         DesiredDeliveryMediums: [client_cognito_identity_provider_1.DeliveryMediumType.EMAIL],
-        UserAttributes: (0, cognitoAttributeMap_1.getCognitoUserAttributesFromQpqUserAttributes)(createUserRequest),
+        // createUserRequest includes password; it has no cognitoAttributeMap entry,
+        // so the mapper drops it rather than writing it as a user attribute.
+        UserAttributes: (0, getCognitoUserAttributesFromQpqUserAttributes_1.getCognitoUserAttributesFromQpqUserAttributes)(createUserRequest),
         ForceAliasCreation: false,
     };
     if (createUserRequest.phoneNumber) {
@@ -33,11 +39,8 @@ const createUser = (userPoolId, region, clientId, createUserRequest) => __awaite
     }
     const response = yield cognitoClient.send(new client_cognito_identity_provider_1.AdminCreateUserCommand(params));
     const username = ((_a = response.User) === null || _a === void 0 ? void 0 : _a.Username) || '';
-    // Set the user's password
     yield (0, setUserPassword_1.setUserPassword)(region, userPoolId, username, createUserRequest.password);
-    // Authenticate the user
-    const authResponse = yield (0, authenticateUser_1.authenticateUser)(userPoolId, clientId, region, false, username, createUserRequest.password);
-    return authResponse;
+    return (0, authenticateUser_1.authenticateUser)(userPoolId, clientId, region, false, username, createUserRequest.password);
 });
 exports.createUser = createUser;
 //# sourceMappingURL=createUser.js.map

package/lib/commonjs/logic/cognito/createUser.js.map

@@ -1 +1 @@
-{"version":3,"file":"createUser.js","sourceRoot":"","sources":["../../../../src/logic/cognito/createUser.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAMmD;AAEnD,wDAAqD;AACrD,yDAAsD;AACtD,+DAAsF;AACtF,uDAAoD;AAE7C,MAAM,UAAU,GAAG,CACxB,UAAkB,EAClB,MAAc,EACd,QAAgB,EAChB,iBAAoC,EACD,EAAE;;IACrC,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAAgC;QAC1C,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,iBAAiB,CAAC,KAAK;QACjC,aAAa,EAAE,oDAAiB,CAAC,QAAQ,EAAE,yBAAyB;QACpE,sBAAsB,EAAE,CAAC,qDAAkB,CAAC,KAAK,CAAC;QAClD,cAAc,EAAE,IAAA,mEAA6C,EAAC,iBAAiB,CAAC;QAChF,kBAAkB,EAAE,KAAK;KAC1B,CAAC;IAEF,IAAI,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,CAAC,sBAAuB,CAAC,IAAI,CAAC,qDAAkB,CAAC,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,yDAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;IAE9E,MAAM,QAAQ,GAAG,CAAA,MAAA,QAAQ,CAAC,IAAI,0CAAE,QAAQ,KAAI,EAAE,CAAC;IAE/C,0BAA0B;IAC1B,MAAM,IAAA,iCAAe,EAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAEhF,wBAAwB;IACxB,MAAM,YAAY,GAA6B,MAAM,IAAA,mCAAgB,EAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAEjJ,OAAO,YAAY,CAAC;AACtB,CAAC,CAAA,CAAC;AAlCW,QAAA,UAAU,cAkCrB","sourcesContent":["import { AuthenticateUserResponse, CreateUserRequest } from 'quidproquo-core';\n\nimport {\n  AdminCreateUserCommand,\n  AdminCreateUserCommandInput,\n  CognitoIdentityProviderClient,\n  DeliveryMediumType,\n  MessageActionType,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { authenticateUser } from './authenticateUser';\nimport { getCognitoUserAttributesFromQpqUserAttributes } from './cognitoAttributeMap';\nimport { setUserPassword } from './setUserPassword';\n\nexport const createUser = async (\n  userPoolId: string,\n  region: string,\n  clientId: string,\n  createUserRequest: CreateUserRequest,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params: AdminCreateUserCommandInput = {\n    UserPoolId: userPoolId,\n    Username: createUserRequest.email,\n    MessageAction: MessageActionType.SUPPRESS, // Don't contact the user\n    DesiredDeliveryMediums: [DeliveryMediumType.EMAIL],\n    UserAttributes: getCognitoUserAttributesFromQpqUserAttributes(createUserRequest),\n    ForceAliasCreation: false,\n  };\n\n  if (createUserRequest.phoneNumber) {\n    params.DesiredDeliveryMediums!.push(DeliveryMediumType.SMS);\n  }\n\n  const response = await cognitoClient.send(new AdminCreateUserCommand(params));\n\n  const username = response.User?.Username || '';\n\n  // Set the user's password\n  await setUserPassword(region, userPoolId, username, createUserRequest.password);\n\n  // Authenticate the user\n  const authResponse: AuthenticateUserResponse = await authenticateUser(userPoolId, clientId, region, false, username, createUserRequest.password);\n\n  return authResponse;\n};\n"]}
+{"version":3,"file":"createUser.js","sourceRoot":"","sources":["../../../../src/logic/cognito/createUser.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAMmD;AAEnD,wDAAqD;AACrD,yDAAsD;AACtD,mHAAgH;AAChH,uDAAoD;AAEpD;;;GAGG;AACI,MAAM,UAAU,GAAG,CACxB,UAAkB,EAClB,MAAc,EACd,QAAgB,EAChB,iBAAoC,EACD,EAAE;;IACrC,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAAgC;QAC1C,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,iBAAiB,CAAC,KAAK;QACjC,aAAa,EAAE,oDAAiB,CAAC,QAAQ,EAAE,yBAAyB;QACpE,sBAAsB,EAAE,CAAC,qDAAkB,CAAC,KAAK,CAAC;QAClD,4EAA4E;QAC5E,qEAAqE;QACrE,cAAc,EAAE,IAAA,6FAA6C,EAAC,iBAAiB,CAAC;QAChF,kBAAkB,EAAE,KAAK;KAC1B,CAAC;IAEF,IAAI,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,CAAC,sBAAuB,CAAC,IAAI,CAAC,qDAAkB,CAAC,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,yDAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;IAE9E,MAAM,QAAQ,GAAG,CAAA,MAAA,QAAQ,CAAC,IAAI,0CAAE,QAAQ,KAAI,EAAE,CAAC;IAE/C,MAAM,IAAA,iCAAe,EAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAEhF,OAAO,IAAA,mCAAgB,EAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AACrG,CAAC,CAAA,CAAC;AAhCW,QAAA,UAAU,cAgCrB","sourcesContent":["import { AuthenticateUserResponse, CreateUserRequest } from 'quidproquo-core';\n\nimport {\n  AdminCreateUserCommand,\n  AdminCreateUserCommandInput,\n  CognitoIdentityProviderClient,\n  DeliveryMediumType,\n  MessageActionType,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { authenticateUser } from './authenticateUser';\nimport { getCognitoUserAttributesFromQpqUserAttributes } from './getCognitoUserAttributesFromQpqUserAttributes';\nimport { setUserPassword } from './setUserPassword';\n\n/**\n * Creates a Cognito user with the requested attributes, activates their password\n * and signs them in, returning the authenticated session.\n */\nexport const createUser = async (\n  userPoolId: string,\n  region: string,\n  clientId: string,\n  createUserRequest: CreateUserRequest,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params: AdminCreateUserCommandInput = {\n    UserPoolId: userPoolId,\n    Username: createUserRequest.email,\n    MessageAction: MessageActionType.SUPPRESS, // Don't contact the user\n    DesiredDeliveryMediums: [DeliveryMediumType.EMAIL],\n    // createUserRequest includes password; it has no cognitoAttributeMap entry,\n    // so the mapper drops it rather than writing it as a user attribute.\n    UserAttributes: getCognitoUserAttributesFromQpqUserAttributes(createUserRequest),\n    ForceAliasCreation: false,\n  };\n\n  if (createUserRequest.phoneNumber) {\n    params.DesiredDeliveryMediums!.push(DeliveryMediumType.SMS);\n  }\n\n  const response = await cognitoClient.send(new AdminCreateUserCommand(params));\n\n  const username = response.User?.Username || '';\n\n  await setUserPassword(region, userPoolId, username, createUserRequest.password);\n\n  return authenticateUser(userPoolId, clientId, region, false, username, createUserRequest.password);\n};\n"]}

package/lib/commonjs/logic/cognito/decodeAccessToken.d.ts

@@ -1,2 +1,13 @@
 import { DecodedAccessToken, QPQConfig } from 'quidproquo-core';
+export declare class InvalidAccessTokenError extends Error {
+    readonly code = "INVALID_ACCESS_TOKEN";
+    constructor();
+}
+/**
+ * Decodes and verifies a Cognito access token for the given user directory,
+ * resolving the pool id from the directory's CloudFormation export. Throws
+ * InvalidAccessTokenError when the token is missing or fails verification.
+ * With ignoreExpiration, an expired but otherwise valid token is returned with
+ * wasValid false.
+ */
 export declare const decodeAccessToken: (userDirectoryName: string, qpqConfig: QPQConfig, accessToken?: string, ignoreExpiration?: boolean) => Promise<DecodedAccessToken>;

package/lib/commonjs/logic/cognito/decodeAccessToken.js

@@ -9,21 +9,40 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.decodeAccessToken = void 0;
+exports.decodeAccessToken = exports.InvalidAccessTokenError = void 0;
 const quidproquo_config_aws_1 = require("quidproquo-config-aws");
 const awsNamingUtils_1 = require("../../awsNamingUtils");
 const getExportedValue_1 = require("../cloudformation/getExportedValue");
 const decodeValidJwt_1 = require("./decodeValidJwt");
+// decodeValidJwt returns null rather than throwing, so this throw is the
+// discriminable signal callers (e.g. the SetAccessToken processor) catch to
+// produce an Unauthorized result.
+class InvalidAccessTokenError extends Error {
+    constructor() {
+        super('Unable to decode access token');
+        this.code = 'INVALID_ACCESS_TOKEN';
+        this.name = 'InvalidAccessTokenError';
+    }
+}
+exports.InvalidAccessTokenError = InvalidAccessTokenError;
+/**
+ * Decodes and verifies a Cognito access token for the given user directory,
+ * resolving the pool id from the directory's CloudFormation export. Throws
+ * InvalidAccessTokenError when the token is missing or fails verification.
+ * With ignoreExpiration, an expired but otherwise valid token is returned with
+ * wasValid false.
+ */
 const decodeAccessToken = (userDirectoryName_1, qpqConfig_1, accessToken_1, ...args_1) => __awaiter(void 0, [userDirectoryName_1, qpqConfig_1, accessToken_1, ...args_1], void 0, function* (userDirectoryName, qpqConfig, accessToken, ignoreExpiration = false) {
     const region = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
     const userPoolId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolIdFromConfig)(userDirectoryName, qpqConfig), region);
     const decodedAuthToken = yield (0, decodeValidJwt_1.decodeValidJwt)(userPoolId, region, ignoreExpiration, accessToken);
-    if (!decodedAuthToken || !(decodedAuthToken === null || decodedAuthToken === void 0 ? void 0 : decodedAuthToken.username)) {
-        throw new Error('Unable to decode access token');
+    if (!(decodedAuthToken === null || decodedAuthToken === void 0 ? void 0 : decodedAuthToken.username)) {
+        throw new InvalidAccessTokenError();
     }
+    // decodeValidJwt only enforces expiry when ignoreExpiration is false, so
+    // recheck here to report whether an ignored-expiry token was actually valid.
     const wasValid = !ignoreExpiration || decodedAuthToken.exp > Math.floor(Date.now() / 1000);
-    const decodedAccesToken = Object.assign(Object.assign({}, decodedAuthToken), { wasValid, userDirectory: userDirectoryName });
-    return decodedAccesToken;
+    return Object.assign(Object.assign({}, decodedAuthToken), { wasValid, userDirectory: userDirectoryName });
 });
 exports.decodeAccessToken = decodeAccessToken;
 //# sourceMappingURL=decodeAccessToken.js.map

package/lib/commonjs/logic/cognito/decodeAccessToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"decodeAccessToken.js","sourceRoot":"","sources":["../../../../src/logic/cognito/decodeAccessToken.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,iEAA0D;AAG1D,yDAA2E;AAC3E,yEAAsE;AACtE,qDAAkD;AAE3C,MAAM,iBAAiB,GAAG,6DAKF,EAAE,oGAJ/B,iBAAyB,EACzB,SAAoB,EACpB,WAAoB,EACpB,mBAA4B,KAAK;IAEjC,MAAM,MAAM,GAAG,yCAAiB,CAAC,gCAAgC,CAAC,SAAS,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,MAAM,IAAA,mCAAgB,EAAC,IAAA,oDAAmC,EAAC,iBAAiB,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;IAErH,MAAM,gBAAgB,GAAG,MAAM,IAAA,+BAAc,EAAC,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;IAEjG,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAA,gBAAgB,aAAhB,gBAAgB,uBAAhB,gBAAgB,CAAE,QAAQ,CAAA,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,gBAAgB,IAAI,gBAAgB,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE3F,MAAM,iBAAiB,mCAClB,gBAAgB,KAEnB,QAAQ,EACR,aAAa,EAAE,iBAAiB,GACjC,CAAC;IAEF,OAAO,iBAAiB,CAAC;AAC3B,CAAC,CAAA,CAAC;AAzBW,QAAA,iBAAiB,qBAyB5B","sourcesContent":["import { qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport { DecodedAccessToken, QPQConfig, qpqCoreUtils } from 'quidproquo-core';\n\nimport { getCFExportNameUserPoolIdFromConfig } from '../../awsNamingUtils';\nimport { getExportedValue } from '../cloudformation/getExportedValue';\nimport { decodeValidJwt } from './decodeValidJwt';\n\nexport const decodeAccessToken = async (\n  userDirectoryName: string,\n  qpqConfig: QPQConfig,\n  accessToken?: string,\n  ignoreExpiration: boolean = false,\n): Promise<DecodedAccessToken> => {\n  const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);\n  const userPoolId = await getExportedValue(getCFExportNameUserPoolIdFromConfig(userDirectoryName, qpqConfig), region);\n\n  const decodedAuthToken = await decodeValidJwt(userPoolId, region, ignoreExpiration, accessToken);\n\n  if (!decodedAuthToken || !decodedAuthToken?.username) {\n    throw new Error('Unable to decode access token');\n  }\n\n  const wasValid = !ignoreExpiration || decodedAuthToken.exp > Math.floor(Date.now() / 1000);\n\n  const decodedAccesToken: DecodedAccessToken = {\n    ...decodedAuthToken,\n\n    wasValid,\n    userDirectory: userDirectoryName,\n  };\n\n  return decodedAccesToken;\n};\n"]}
+{"version":3,"file":"decodeAccessToken.js","sourceRoot":"","sources":["../../../../src/logic/cognito/decodeAccessToken.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,iEAA0D;AAG1D,yDAA2E;AAC3E,yEAAsE;AACtE,qDAAkD;AAElD,yEAAyE;AACzE,4EAA4E;AAC5E,kCAAkC;AAClC,MAAa,uBAAwB,SAAQ,KAAK;IAGhD;QACE,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAHhC,SAAI,GAAG,sBAAsB,CAAC;QAIrC,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAPD,0DAOC;AAED;;;;;;GAMG;AACI,MAAM,iBAAiB,GAAG,6DAKF,EAAE,oGAJ/B,iBAAyB,EACzB,SAAoB,EACpB,WAAoB,EACpB,mBAA4B,KAAK;IAEjC,MAAM,MAAM,GAAG,yCAAiB,CAAC,gCAAgC,CAAC,SAAS,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,MAAM,IAAA,mCAAgB,EAAC,IAAA,oDAAmC,EAAC,iBAAiB,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;IAErH,MAAM,gBAAgB,GAAG,MAAM,IAAA,+BAAc,EAAC,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;IAEjG,IAAI,CAAC,CAAA,gBAAgB,aAAhB,gBAAgB,uBAAhB,gBAAgB,CAAE,QAAQ,CAAA,EAAE,CAAC;QAChC,MAAM,IAAI,uBAAuB,EAAE,CAAC;IACtC,CAAC;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,CAAC,gBAAgB,IAAI,gBAAgB,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE3F,uCACK,gBAAgB,KAEnB,QAAQ,EACR,aAAa,EAAE,iBAAiB,IAChC;AACJ,CAAC,CAAA,CAAC;AAzBW,QAAA,iBAAiB,qBAyB5B","sourcesContent":["import { qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport { DecodedAccessToken, QPQConfig } from 'quidproquo-core';\n\nimport { getCFExportNameUserPoolIdFromConfig } from '../../awsNamingUtils';\nimport { getExportedValue } from '../cloudformation/getExportedValue';\nimport { decodeValidJwt } from './decodeValidJwt';\n\n// decodeValidJwt returns null rather than throwing, so this throw is the\n// discriminable signal callers (e.g. the SetAccessToken processor) catch to\n// produce an Unauthorized result.\nexport class InvalidAccessTokenError extends Error {\n  readonly code = 'INVALID_ACCESS_TOKEN';\n\n  constructor() {\n    super('Unable to decode access token');\n    this.name = 'InvalidAccessTokenError';\n  }\n}\n\n/**\n * Decodes and verifies a Cognito access token for the given user directory,\n * resolving the pool id from the directory's CloudFormation export. Throws\n * InvalidAccessTokenError when the token is missing or fails verification.\n * With ignoreExpiration, an expired but otherwise valid token is returned with\n * wasValid false.\n */\nexport const decodeAccessToken = async (\n  userDirectoryName: string,\n  qpqConfig: QPQConfig,\n  accessToken?: string,\n  ignoreExpiration: boolean = false,\n): Promise<DecodedAccessToken> => {\n  const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);\n  const userPoolId = await getExportedValue(getCFExportNameUserPoolIdFromConfig(userDirectoryName, qpqConfig), region);\n\n  const decodedAuthToken = await decodeValidJwt(userPoolId, region, ignoreExpiration, accessToken);\n\n  if (!decodedAuthToken?.username) {\n    throw new InvalidAccessTokenError();\n  }\n\n  // decodeValidJwt only enforces expiry when ignoreExpiration is false, so\n  // recheck here to report whether an ignored-expiry token was actually valid.\n  const wasValid = !ignoreExpiration || decodedAuthToken.exp > Math.floor(Date.now() / 1000);\n\n  return {\n    ...decodedAuthToken,\n\n    wasValid,\n    userDirectory: userDirectoryName,\n  };\n};\n"]}

package/lib/commonjs/logic/cognito/decodeValidJwt.d.ts

@@ -1,2 +1,8 @@
-import { DecodedAccessToken } from 'quidproquo-core';
-export declare const decodeValidJwt: (userPoolId: string, region: string, ignoreExpiration: boolean, accessToken?: string) => Promise<Omit<DecodedAccessToken, "userDirectory"> | null>;
+import { DecodedAccessToken, Nullable } from 'quidproquo-core';
+/**
+ * Verifies a Cognito access token and returns its decoded qpq shape: signature is
+ * checked against the pool's JWKS (RS256 only), plus issuer, expiry (unless
+ * ignoreExpiration) and token_use. Returns null for anything that fails; failures
+ * are logged in summary form only, never the token itself.
+ */
+export declare const decodeValidJwt: (userPoolId: string, region: string, ignoreExpiration: boolean, accessToken?: string) => Promise<Nullable<Omit<DecodedAccessToken, "userDirectory">>>;

package/lib/commonjs/logic/cognito/decodeValidJwt.js

@@ -8,13 +8,16 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.decodeValidJwt = void 0;
 const jsonwebtoken_1 = require("jsonwebtoken");
-const jwks_rsa_1 = __importDefault(require("jwks-rsa"));
+const getCognitoJwksClient_1 = require("./getCognitoJwksClient");
+/**
+ * Verifies a Cognito access token and returns its decoded qpq shape: signature is
+ * checked against the pool's JWKS (RS256 only), plus issuer, expiry (unless
+ * ignoreExpiration) and token_use. Returns null for anything that fails; failures
+ * are logged in summary form only, never the token itself.
+ */
 const decodeValidJwt = (userPoolId, region, ignoreExpiration, accessToken) => __awaiter(void 0, void 0, void 0, function* () {
     if (!accessToken) {
         return null;
@@ -24,22 +27,25 @@ const decodeValidJwt = (userPoolId, region, ignoreExpiration, accessToken) => __
         if (!decodedToken) {
             return null;
         }
-        const client = (0, jwks_rsa_1.default)({
-            jwksUri: `https://cognito-idp.${region}.amazonaws.com/${userPoolId}/.well-known/jwks.json`,
-        });
+        const client = (0, getCognitoJwksClient_1.getCognitoJwksClient)(`https://cognito-idp.${region}.amazonaws.com/${userPoolId}/.well-known/jwks.json`);
         const key = yield client.getSigningKey(decodedToken.header.kid);
         const signingKey = key.getPublicKey();
         const payload = (0, jsonwebtoken_1.verify)(accessToken, signingKey, {
             algorithms: ['RS256'],
+            issuer: `https://cognito-idp.${region}.amazonaws.com/${userPoolId}`,
             ignoreExpiration,
         });
-        const decodedAccessToken = {
+        // An id token from the same pool passes signature verification too; only
+        // access tokens are acceptable here.
+        if (payload.token_use !== 'access') {
+            return null;
+        }
+        return {
             userId: payload.sub,
             username: payload.username,
             exp: payload.exp,
             wasValid: true,
         };
-        return decodedAccessToken;
     }
     catch (e) {
         const summary = e instanceof Error ? `${e.name}: ${e.message}` : 'unknown error';

package/lib/commonjs/logic/cognito/decodeValidJwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"decodeValidJwt.js","sourceRoot":"","sources":["../../../../src/logic/cognito/decodeValidJwt.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAEA,+CAA8C;AAC9C,wDAAkC;AAkB3B,MAAM,cAAc,GAAG,CAC5B,UAAkB,EAClB,MAAc,EACd,gBAAyB,EACzB,WAAoB,EACuC,EAAE;IAC7D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAA,qBAAM,EAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,kBAAU,EAAC;YACxB,OAAO,EAAE,uBAAuB,MAAM,kBAAkB,UAAU,wBAAwB;SAC3F,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;QAEtC,MAAM,OAAO,GAAG,IAAA,qBAAM,EAAC,WAAW,EAAE,UAAU,EAAE;YAC9C,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,gBAAgB;SACjB,CAAe,CAAC;QAEjB,MAAM,kBAAkB,GAA8C;YACpE,MAAM,EAAE,OAAO,CAAC,GAAG;YACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,QAAQ,EAAE,IAAI;SACf,CAAC;QAEF,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,OAAO,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAA,CAAC;AAzCW,QAAA,cAAc,kBAyCzB","sourcesContent":["import { DecodedAccessToken } from 'quidproquo-core';\n\nimport { decode, verify } from 'jsonwebtoken';\nimport jwksClient from 'jwks-rsa';\n\n// TODO: Check whey we need this? I think you should be able to get types from the lib?\ntype JwtPayload = {\n  sub: string;\n  iss: string;\n  client_id: string;\n  origin_jti: string;\n  event_id: string;\n  token_use: string;\n  scope: string;\n  auth_time: number;\n  exp: number;\n  iat: number;\n  jti: string;\n  username: string;\n};\n\nexport const decodeValidJwt = async (\n  userPoolId: string,\n  region: string,\n  ignoreExpiration: boolean,\n  accessToken?: string,\n): Promise<Omit<DecodedAccessToken, 'userDirectory'> | null> => {\n  if (!accessToken) {\n    return null;\n  }\n\n  try {\n    const decodedToken = decode(accessToken, { complete: true });\n    if (!decodedToken) {\n      return null;\n    }\n\n    const client = jwksClient({\n      jwksUri: `https://cognito-idp.${region}.amazonaws.com/${userPoolId}/.well-known/jwks.json`,\n    });\n\n    const key = await client.getSigningKey(decodedToken.header.kid);\n    const signingKey = key.getPublicKey();\n\n    const payload = verify(accessToken, signingKey, {\n      algorithms: ['RS256'],\n      ignoreExpiration,\n    }) as JwtPayload;\n\n    const decodedAccessToken: Omit<DecodedAccessToken, 'userDirectory'> = {\n      userId: payload.sub,\n      username: payload.username,\n      exp: payload.exp,\n      wasValid: true,\n    };\n\n    return decodedAccessToken;\n  } catch (e) {\n    const summary = e instanceof Error ? `${e.name}: ${e.message}` : 'unknown error';\n    console.log('Failed to decode jwt token:', summary);\n    return null;\n  }\n};\n"]}
+{"version":3,"file":"decodeValidJwt.js","sourceRoot":"","sources":["../../../../src/logic/cognito/decodeValidJwt.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,+CAA8C;AAE9C,iEAA8D;AAW9D;;;;;GAKG;AACI,MAAM,cAAc,GAAG,CAC5B,UAAkB,EAClB,MAAc,EACd,gBAAyB,EACzB,WAAoB,EAC0C,EAAE;IAChE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAA,qBAAM,EAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,2CAAoB,EAAC,uBAAuB,MAAM,kBAAkB,UAAU,wBAAwB,CAAC,CAAC;QAEvH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;QAEtC,MAAM,OAAO,GAAG,IAAA,qBAAM,EAAC,WAAW,EAAE,UAAU,EAAE;YAC9C,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,uBAAuB,MAAM,kBAAkB,UAAU,EAAE;YACnE,gBAAgB;SACjB,CAA8B,CAAC;QAEhC,yEAAyE;QACzE,qCAAqC;QACrC,IAAI,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,GAAG;YACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,QAAQ,EAAE,IAAI;SACf,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,OAAO,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAA,CAAC;AA5CW,QAAA,cAAc,kBA4CzB","sourcesContent":["import { DecodedAccessToken, Nullable } from 'quidproquo-core';\n\nimport { decode, verify } from 'jsonwebtoken';\n\nimport { getCognitoJwksClient } from './getCognitoJwksClient';\n\n// The jsonwebtoken lib types every claim as optional, so the Cognito\n// access-token claims this decoder relies on are typed here.\ntype CognitoAccessTokenPayload = {\n  sub: string;\n  token_use: string;\n  username: string;\n  exp: number;\n};\n\n/**\n * Verifies a Cognito access token and returns its decoded qpq shape: signature is\n * checked against the pool's JWKS (RS256 only), plus issuer, expiry (unless\n * ignoreExpiration) and token_use. Returns null for anything that fails; failures\n * are logged in summary form only, never the token itself.\n */\nexport const decodeValidJwt = async (\n  userPoolId: string,\n  region: string,\n  ignoreExpiration: boolean,\n  accessToken?: string,\n): Promise<Nullable<Omit<DecodedAccessToken, 'userDirectory'>>> => {\n  if (!accessToken) {\n    return null;\n  }\n\n  try {\n    const decodedToken = decode(accessToken, { complete: true });\n    if (!decodedToken) {\n      return null;\n    }\n\n    const client = getCognitoJwksClient(`https://cognito-idp.${region}.amazonaws.com/${userPoolId}/.well-known/jwks.json`);\n\n    const key = await client.getSigningKey(decodedToken.header.kid);\n    const signingKey = key.getPublicKey();\n\n    const payload = verify(accessToken, signingKey, {\n      algorithms: ['RS256'],\n      issuer: `https://cognito-idp.${region}.amazonaws.com/${userPoolId}`,\n      ignoreExpiration,\n    }) as CognitoAccessTokenPayload;\n\n    // An id token from the same pool passes signature verification too; only\n    // access tokens are acceptable here.\n    if (payload.token_use !== 'access') {\n      return null;\n    }\n\n    return {\n      userId: payload.sub,\n      username: payload.username,\n      exp: payload.exp,\n      wasValid: true,\n    };\n  } catch (e) {\n    const summary = e instanceof Error ? `${e.name}: ${e.message}` : 'unknown error';\n    console.log('Failed to decode jwt token:', summary);\n    return null;\n  }\n};\n"]}

package/lib/commonjs/logic/cognito/forgotPassword.js

@@ -13,6 +13,7 @@ exports.forgotPassword = void 0;
 const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
 const createAwsClient_1 = require("../createAwsClient");
 const calculateSecretHash_1 = require("./utils/calculateSecretHash");
+const cognitoCodeDeliveryDetailsToQpqDeliveryDetails_1 = require("./utils/cognitoCodeDeliveryDetailsToQpqDeliveryDetails");
 const getUserPoolClientSecret_1 = require("./getUserPoolClientSecret");
 const forgotPassword = (userPoolId, clientId, region, username) => __awaiter(void 0, void 0, void 0, function* () {
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
@@ -29,12 +30,7 @@ const forgotPassword = (userPoolId, clientId, region, username) => __awaiter(voi
         },
     };
     const response = yield cognitoClient.send(new client_cognito_identity_provider_1.ForgotPasswordCommand(params));
-    const deliveryInfo = {
-        attributeName: response.CodeDeliveryDetails.AttributeName || 'email',
-        destination: response.CodeDeliveryDetails.Destination || 'unknown@email.com',
-        deliveryMedium: response.CodeDeliveryDetails.DeliveryMedium || 'EMAIL',
-    };
-    return deliveryInfo;
+    return (0, cognitoCodeDeliveryDetailsToQpqDeliveryDetails_1.cognitoCodeDeliveryDetailsToQpqDeliveryDetails)(response.CodeDeliveryDetails);
 });
 exports.forgotPassword = forgotPassword;
 //# sourceMappingURL=forgotPassword.js.map

package/lib/commonjs/logic/cognito/forgotPassword.js.map

@@ -1 +1 @@
-{"version":3,"file":"forgotPassword.js","sourceRoot":"","sources":["../../../../src/logic/cognito/forgotPassword.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAA6I;AAE7I,wDAAqD;AACrD,qEAAkE;AAClE,uEAAoE;AAE7D,MAAM,cAAc,GAAG,CAC5B,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,QAAgB,EACwB,EAAE;IAC1C,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,IAAA,iDAAuB,EAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,IAAA,yCAAmB,EAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAA+B;QACzC,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,UAAU;QACtB,cAAc,EAAE;YACd,aAAa,EAAE,MAAM;SACtB;KACF,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,wDAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IAE7E,MAAM,YAAY,GAAG;QACnB,aAAa,EAAE,QAAQ,CAAC,mBAAoB,CAAC,aAAa,IAAI,OAAO;QACrE,WAAW,EAAE,QAAQ,CAAC,mBAAoB,CAAC,WAAW,IAAI,mBAAmB;QAC7E,cAAc,EAAE,QAAQ,CAAC,mBAAoB,CAAC,cAAc,IAAI,OAAO;KACvC,CAAC;IAEnC,OAAO,YAAY,CAAC;AACtB,CAAC,CAAA,CAAC;AA/BW,QAAA,cAAc,kBA+BzB","sourcesContent":["import { AuthenticationDeliveryDetails } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ForgotPasswordCommand, ForgotPasswordCommandInput } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\nexport const forgotPassword = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  username: string,\n): Promise<AuthenticationDeliveryDetails> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  const params: ForgotPasswordCommandInput = {\n    ClientId: clientId,\n    Username: username,\n    SecretHash: secretHash,\n    ClientMetadata: {\n      userInitiated: 'true',\n    },\n  };\n\n  const response = await cognitoClient.send(new ForgotPasswordCommand(params));\n\n  const deliveryInfo = {\n    attributeName: response.CodeDeliveryDetails!.AttributeName || 'email',\n    destination: response.CodeDeliveryDetails!.Destination || 'unknown@email.com',\n    deliveryMedium: response.CodeDeliveryDetails!.DeliveryMedium || 'EMAIL',\n  } as AuthenticationDeliveryDetails;\n\n  return deliveryInfo;\n};\n"]}
+{"version":3,"file":"forgotPassword.js","sourceRoot":"","sources":["../../../../src/logic/cognito/forgotPassword.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAA6I;AAE7I,wDAAqD;AACrD,qEAAkE;AAClE,2HAAwH;AACxH,uEAAoE;AAE7D,MAAM,cAAc,GAAG,CAC5B,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,QAAgB,EACwB,EAAE;IAC1C,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,IAAA,iDAAuB,EAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,IAAA,yCAAmB,EAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAA+B;QACzC,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,UAAU;QACtB,cAAc,EAAE;YACd,aAAa,EAAE,MAAM;SACtB;KACF,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,wDAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IAE7E,OAAO,IAAA,+FAA8C,EAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;AACtF,CAAC,CAAA,CAAC;AAzBW,QAAA,cAAc,kBAyBzB","sourcesContent":["import { AuthenticationDeliveryDetails } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ForgotPasswordCommand, ForgotPasswordCommandInput } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { cognitoCodeDeliveryDetailsToQpqDeliveryDetails } from './utils/cognitoCodeDeliveryDetailsToQpqDeliveryDetails';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\nexport const forgotPassword = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  username: string,\n): Promise<AuthenticationDeliveryDetails> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  const params: ForgotPasswordCommandInput = {\n    ClientId: clientId,\n    Username: username,\n    SecretHash: secretHash,\n    ClientMetadata: {\n      userInitiated: 'true',\n    },\n  };\n\n  const response = await cognitoClient.send(new ForgotPasswordCommand(params));\n\n  return cognitoCodeDeliveryDetailsToQpqDeliveryDetails(response.CodeDeliveryDetails);\n};\n"]}

package/lib/commonjs/logic/cognito/getCognitoJwksClient.d.ts

@@ -0,0 +1,7 @@
+import { JwksClient } from 'jwks-rsa';
+/**
+ * Returns the JWKS client for a Cognito jwks.json uri. Memoized because jwks-rsa
+ * caches fetched signing keys per client instance; a fresh client per verification
+ * would refetch the pool's JWKS over HTTP on every call.
+ */
+export declare const getCognitoJwksClient: (jwksUri: string) => JwksClient;

package/lib/commonjs/logic/cognito/getCognitoJwksClient.js

@@ -0,0 +1,15 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCognitoJwksClient = void 0;
+const jwks_rsa_1 = __importDefault(require("jwks-rsa"));
+const memoFunc_1 = require("../cache/memoFunc");
+/**
+ * Returns the JWKS client for a Cognito jwks.json uri. Memoized because jwks-rsa
+ * caches fetched signing keys per client instance; a fresh client per verification
+ * would refetch the pool's JWKS over HTTP on every call.
+ */
+exports.getCognitoJwksClient = (0, memoFunc_1.memoFunc)((jwksUri) => (0, jwks_rsa_1.default)({ jwksUri }));
+//# sourceMappingURL=getCognitoJwksClient.js.map

package/lib/commonjs/logic/cognito/getCognitoJwksClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getCognitoJwksClient.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getCognitoJwksClient.ts"],"names":[],"mappings":";;;;;;AAAA,wDAAkD;AAElD,gDAA6C;AAE7C;;;;GAIG;AACU,QAAA,oBAAoB,GAAG,IAAA,mBAAQ,EAAC,CAAC,OAAe,EAAc,EAAE,CAAC,IAAA,kBAAU,EAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC","sourcesContent":["import jwksClient, { JwksClient } from 'jwks-rsa';\n\nimport { memoFunc } from '../cache/memoFunc';\n\n/**\n * Returns the JWKS client for a Cognito jwks.json uri. Memoized because jwks-rsa\n * caches fetched signing keys per client instance; a fresh client per verification\n * would refetch the pool's JWKS over HTTP on every call.\n */\nexport const getCognitoJwksClient = memoFunc((jwksUri: string): JwksClient => jwksClient({ jwksUri }));\n"]}