quidproquo-actionprocessor-awslambda 0.1.10 → 0.1.12

package/lib/commonjs/logic/cognito/getCognitoUserAttributesFromQpqUserAttributes.d.ts

@@ -0,0 +1,8 @@
+import { UserAttributes } from 'quidproquo-core';
+import { CognitoUserAttribute } from './utils/CognitoUserAttribute';
+/**
+ * Maps qpq UserAttributes onto Cognito Name/Value pairs. Keys with no Cognito
+ * mapping (e.g. password on CreateUserRequest) and absent or empty values are
+ * dropped; everything else is stringified (booleans become 'true'/'false').
+ */
+export declare const getCognitoUserAttributesFromQpqUserAttributes: (userAttributes: UserAttributes) => CognitoUserAttribute[];

package/lib/commonjs/logic/cognito/getCognitoUserAttributesFromQpqUserAttributes.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCognitoUserAttributesFromQpqUserAttributes = void 0;
+const cognitoAttributeMap_1 = require("./cognitoAttributeMap");
+/**
+ * Maps qpq UserAttributes onto Cognito Name/Value pairs. Keys with no Cognito
+ * mapping (e.g. password on CreateUserRequest) and absent or empty values are
+ * dropped; everything else is stringified (booleans become 'true'/'false').
+ */
+const getCognitoUserAttributesFromQpqUserAttributes = (userAttributes) => {
+    return Object.keys(userAttributes)
+        .filter((key) => userAttributes[key] !== undefined && userAttributes[key] !== null)
+        .map((key) => ({
+        Name: cognitoAttributeMap_1.cognitoAttributeMap[key],
+        Value: `${userAttributes[key]}`,
+    }))
+        .filter((attribute) => !!attribute.Name && !!attribute.Value);
+};
+exports.getCognitoUserAttributesFromQpqUserAttributes = getCognitoUserAttributesFromQpqUserAttributes;
+//# sourceMappingURL=getCognitoUserAttributesFromQpqUserAttributes.js.map

package/lib/commonjs/logic/cognito/getCognitoUserAttributesFromQpqUserAttributes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getCognitoUserAttributesFromQpqUserAttributes.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getCognitoUserAttributesFromQpqUserAttributes.ts"],"names":[],"mappings":";;;AAGA,+DAA4D;AAE5D;;;;GAIG;AACI,MAAM,6CAA6C,GAAG,CAAC,cAA8B,EAA0B,EAAE;IACtH,OAAQ,MAAM,CAAC,IAAI,CAAC,cAAc,CAA8B;SAC7D,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;SAClF,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACb,IAAI,EAAE,yCAAmB,CAAC,GAAG,CAAC;QAC9B,KAAK,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,EAAE;KAChC,CAAC,CAAC;SACF,MAAM,CAAC,CAAC,SAAS,EAAqC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACrG,CAAC,CAAC;AARW,QAAA,6CAA6C,iDAQxD","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { CognitoUserAttribute } from './utils/CognitoUserAttribute';\nimport { cognitoAttributeMap } from './cognitoAttributeMap';\n\n/**\n * Maps qpq UserAttributes onto Cognito Name/Value pairs. Keys with no Cognito\n * mapping (e.g. password on CreateUserRequest) and absent or empty values are\n * dropped; everything else is stringified (booleans become 'true'/'false').\n */\nexport const getCognitoUserAttributesFromQpqUserAttributes = (userAttributes: UserAttributes): CognitoUserAttribute[] => {\n  return (Object.keys(userAttributes) as (keyof UserAttributes)[])\n    .filter((key) => userAttributes[key] !== undefined && userAttributes[key] !== null)\n    .map((key) => ({\n      Name: cognitoAttributeMap[key],\n      Value: `${userAttributes[key]}`,\n    }))\n    .filter((attribute): attribute is CognitoUserAttribute => !!attribute.Name && !!attribute.Value);\n};\n"]}

package/lib/commonjs/logic/cognito/getQpqAttributeObjectFromCognitoKeyValue.d.ts

@@ -0,0 +1,7 @@
+import { UserAttributes } from 'quidproquo-core';
+/**
+ * Maps a single Cognito attribute name/value onto a partial UserAttributes object.
+ * Names with no qpq mapping (e.g. cognito:groups) produce an empty object, and
+ * email_verified is coerced from Cognito's 'true'/'false' string to a boolean.
+ */
+export declare const getQpqAttributeObjectFromCognitoKeyValue: (key: string, value: string) => UserAttributes;

package/lib/commonjs/logic/cognito/getQpqAttributeObjectFromCognitoKeyValue.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getQpqAttributeObjectFromCognitoKeyValue = void 0;
+const cognitoAttributeMap_1 = require("./cognitoAttributeMap");
+const reversedCognitoAttributeMap = Object.fromEntries(Object.entries(cognitoAttributeMap_1.cognitoAttributeMap).map(([qpqKey, cognitoName]) => [cognitoName, qpqKey]));
+/**
+ * Maps a single Cognito attribute name/value onto a partial UserAttributes object.
+ * Names with no qpq mapping (e.g. cognito:groups) produce an empty object, and
+ * email_verified is coerced from Cognito's 'true'/'false' string to a boolean.
+ */
+const getQpqAttributeObjectFromCognitoKeyValue = (key, value) => {
+    const userAttributeKey = reversedCognitoAttributeMap[key];
+    if (!userAttributeKey) {
+        return {};
+    }
+    if (userAttributeKey === 'emailVerified') {
+        return { emailVerified: value === 'true' };
+    }
+    return { [userAttributeKey]: value };
+};
+exports.getQpqAttributeObjectFromCognitoKeyValue = getQpqAttributeObjectFromCognitoKeyValue;
+//# sourceMappingURL=getQpqAttributeObjectFromCognitoKeyValue.js.map

package/lib/commonjs/logic/cognito/getQpqAttributeObjectFromCognitoKeyValue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getQpqAttributeObjectFromCognitoKeyValue.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getQpqAttributeObjectFromCognitoKeyValue.ts"],"names":[],"mappings":";;;AAEA,+DAA4D;AAE5D,MAAM,2BAA2B,GAAyC,MAAM,CAAC,WAAW,CAC1F,MAAM,CAAC,OAAO,CAAC,yCAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,MAA8B,CAAC,CAAC,CAClH,CAAC;AAEF;;;;GAIG;AACI,MAAM,wCAAwC,GAAG,CAAC,GAAW,EAAE,KAAa,EAAkB,EAAE;IACrG,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAE1D,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,gBAAgB,KAAK,eAAe,EAAE,CAAC;QACzC,OAAO,EAAE,aAAa,EAAE,KAAK,KAAK,MAAM,EAAE,CAAC;IAC7C,CAAC;IAED,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC;AACvC,CAAC,CAAC;AAZW,QAAA,wCAAwC,4CAYnD","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { cognitoAttributeMap } from './cognitoAttributeMap';\n\nconst reversedCognitoAttributeMap: Record<string, keyof UserAttributes> = Object.fromEntries(\n  Object.entries(cognitoAttributeMap).map(([qpqKey, cognitoName]) => [cognitoName, qpqKey as keyof UserAttributes]),\n);\n\n/**\n * Maps a single Cognito attribute name/value onto a partial UserAttributes object.\n * Names with no qpq mapping (e.g. cognito:groups) produce an empty object, and\n * email_verified is coerced from Cognito's 'true'/'false' string to a boolean.\n */\nexport const getQpqAttributeObjectFromCognitoKeyValue = (key: string, value: string): UserAttributes => {\n  const userAttributeKey = reversedCognitoAttributeMap[key];\n\n  if (!userAttributeKey) {\n    return {};\n  }\n\n  if (userAttributeKey === 'emailVerified') {\n    return { emailVerified: value === 'true' };\n  }\n\n  return { [userAttributeKey]: value };\n};\n"]}

package/lib/commonjs/logic/cognito/getQpqAttributesFromCognitoStringMap.d.ts

@@ -0,0 +1,6 @@
+import { UserAttributes } from 'quidproquo-core';
+/**
+ * Maps a Cognito name-to-value record (as delivered in lambda trigger events)
+ * onto the qpq UserAttributes shape.
+ */
+export declare const getQpqAttributesFromCognitoStringMap: (cognitoUserAttributes: Record<string, string>) => UserAttributes;

package/lib/commonjs/logic/cognito/getQpqAttributesFromCognitoStringMap.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getQpqAttributesFromCognitoStringMap = void 0;
+const getQpqAttributeObjectFromCognitoKeyValue_1 = require("./getQpqAttributeObjectFromCognitoKeyValue");
+/**
+ * Maps a Cognito name-to-value record (as delivered in lambda trigger events)
+ * onto the qpq UserAttributes shape.
+ */
+const getQpqAttributesFromCognitoStringMap = (cognitoUserAttributes) => {
+    const userAttributes = {};
+    for (const [key, value] of Object.entries(cognitoUserAttributes)) {
+        Object.assign(userAttributes, (0, getQpqAttributeObjectFromCognitoKeyValue_1.getQpqAttributeObjectFromCognitoKeyValue)(key, value));
+    }
+    return userAttributes;
+};
+exports.getQpqAttributesFromCognitoStringMap = getQpqAttributesFromCognitoStringMap;
+//# sourceMappingURL=getQpqAttributesFromCognitoStringMap.js.map

package/lib/commonjs/logic/cognito/getQpqAttributesFromCognitoStringMap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getQpqAttributesFromCognitoStringMap.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getQpqAttributesFromCognitoStringMap.ts"],"names":[],"mappings":";;;AAEA,yGAAsG;AAEtG;;;GAGG;AACI,MAAM,oCAAoC,GAAG,CAAC,qBAA6C,EAAkB,EAAE;IACpH,MAAM,cAAc,GAAmB,EAAE,CAAC;IAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACjE,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,IAAA,mFAAwC,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,OAAO,cAAc,CAAC;AACxB,CAAC,CAAC;AARW,QAAA,oCAAoC,wCAQ/C","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { getQpqAttributeObjectFromCognitoKeyValue } from './getQpqAttributeObjectFromCognitoKeyValue';\n\n/**\n * Maps a Cognito name-to-value record (as delivered in lambda trigger events)\n * onto the qpq UserAttributes shape.\n */\nexport const getQpqAttributesFromCognitoStringMap = (cognitoUserAttributes: Record<string, string>): UserAttributes => {\n  const userAttributes: UserAttributes = {};\n\n  for (const [key, value] of Object.entries(cognitoUserAttributes)) {\n    Object.assign(userAttributes, getQpqAttributeObjectFromCognitoKeyValue(key, value));\n  }\n\n  return userAttributes;\n};\n"]}

package/lib/commonjs/logic/cognito/getQpqAttributesFromCognitoUserAttributes.d.ts

@@ -0,0 +1,4 @@
+import { UserAttributes } from 'quidproquo-core';
+import { CognitoUserAttribute } from './utils/CognitoUserAttribute';
+/** Maps a list of Cognito user attributes onto the qpq UserAttributes shape. */
+export declare const getQpqAttributesFromCognitoUserAttributes: (cognitoUserAttributes: CognitoUserAttribute[]) => UserAttributes;

package/lib/commonjs/logic/cognito/getQpqAttributesFromCognitoUserAttributes.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getQpqAttributesFromCognitoUserAttributes = void 0;
+const getQpqAttributeObjectFromCognitoKeyValue_1 = require("./getQpqAttributeObjectFromCognitoKeyValue");
+/** Maps a list of Cognito user attributes onto the qpq UserAttributes shape. */
+const getQpqAttributesFromCognitoUserAttributes = (cognitoUserAttributes) => {
+    const userAttributes = {};
+    for (const { Name, Value } of cognitoUserAttributes) {
+        Object.assign(userAttributes, (0, getQpqAttributeObjectFromCognitoKeyValue_1.getQpqAttributeObjectFromCognitoKeyValue)(Name, Value));
+    }
+    return userAttributes;
+};
+exports.getQpqAttributesFromCognitoUserAttributes = getQpqAttributesFromCognitoUserAttributes;
+//# sourceMappingURL=getQpqAttributesFromCognitoUserAttributes.js.map

package/lib/commonjs/logic/cognito/getQpqAttributesFromCognitoUserAttributes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getQpqAttributesFromCognitoUserAttributes.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getQpqAttributesFromCognitoUserAttributes.ts"],"names":[],"mappings":";;;AAGA,yGAAsG;AAEtG,gFAAgF;AACzE,MAAM,yCAAyC,GAAG,CAAC,qBAA6C,EAAkB,EAAE;IACzH,MAAM,cAAc,GAAmB,EAAE,CAAC;IAE1C,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,qBAAqB,EAAE,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,IAAA,mFAAwC,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACvF,CAAC;IAED,OAAO,cAAc,CAAC;AACxB,CAAC,CAAC;AARW,QAAA,yCAAyC,6CAQpD","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { CognitoUserAttribute } from './utils/CognitoUserAttribute';\nimport { getQpqAttributeObjectFromCognitoKeyValue } from './getQpqAttributeObjectFromCognitoKeyValue';\n\n/** Maps a list of Cognito user attributes onto the qpq UserAttributes shape. */\nexport const getQpqAttributesFromCognitoUserAttributes = (cognitoUserAttributes: CognitoUserAttribute[]): UserAttributes => {\n  const userAttributes: UserAttributes = {};\n\n  for (const { Name, Value } of cognitoUserAttributes) {\n    Object.assign(userAttributes, getQpqAttributeObjectFromCognitoKeyValue(Name, Value));\n  }\n\n  return userAttributes;\n};\n"]}

package/lib/commonjs/logic/cognito/getUserAttributes.js

@@ -12,19 +12,17 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getUserAttributes = void 0;
 const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
 const createAwsClient_1 = require("../createAwsClient");
-const cognitoAttributeMap_1 = require("./cognitoAttributeMap");
+const getValidCognitoUserAttributes_1 = require("./utils/getValidCognitoUserAttributes");
+const getQpqAttributesFromCognitoUserAttributes_1 = require("./getQpqAttributesFromCognitoUserAttributes");
 const getUserAttributes = (userPoolId, region, username) => __awaiter(void 0, void 0, void 0, function* () {
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
         region,
     });
-    const params = {
+    const response = yield cognitoClient.send(new client_cognito_identity_provider_1.AdminGetUserCommand({
         UserPoolId: userPoolId,
         Username: username,
-    };
-    const response = yield cognitoClient.send(new client_cognito_identity_provider_1.AdminGetUserCommand(params));
-    const validAttributes = (response.UserAttributes || []).filter((attr) => attr.Name && attr.Value);
-    const attributes = (0, cognitoAttributeMap_1.getQpqAttributesFromCognitoUserAttributes)(validAttributes);
-    return attributes;
+    }));
+    return (0, getQpqAttributesFromCognitoUserAttributes_1.getQpqAttributesFromCognitoUserAttributes)((0, getValidCognitoUserAttributes_1.getValidCognitoUserAttributes)(response.UserAttributes));
 });
 exports.getUserAttributes = getUserAttributes;
 //# sourceMappingURL=getUserAttributes.js.map

package/lib/commonjs/logic/cognito/getUserAttributes.js.map

@@ -1 +1 @@
-{"version":3,"file":"getUserAttributes.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getUserAttributes.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAA+G;AAE/G,wDAAqD;AACrD,+DAAkF;AAE3E,MAAM,iBAAiB,GAAG,CAAO,UAAkB,EAAE,MAAc,EAAE,QAAgB,EAA2B,EAAE;IACvH,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;KACnB,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,sDAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IAE3E,MAAM,eAAe,GAAG,CAAC,QAAQ,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAsC,CAAC;IAEvI,MAAM,UAAU,GAAG,IAAA,+DAAyC,EAAC,eAAe,CAAC,CAAC;IAE9E,OAAO,UAAU,CAAC;AACpB,CAAC,CAAA,CAAC;AAjBW,QAAA,iBAAiB,qBAiB5B","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { AdminGetUserCommand, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getQpqAttributesFromCognitoUserAttributes } from './cognitoAttributeMap';\n\nexport const getUserAttributes = async (userPoolId: string, region: string, username: string): Promise<UserAttributes> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params = {\n    UserPoolId: userPoolId,\n    Username: username,\n  };\n\n  const response = await cognitoClient.send(new AdminGetUserCommand(params));\n\n  const validAttributes = (response.UserAttributes || []).filter((attr) => attr.Name && attr.Value) as { Name: string; Value: string }[];\n\n  const attributes = getQpqAttributesFromCognitoUserAttributes(validAttributes);\n\n  return attributes;\n};\n"]}
+{"version":3,"file":"getUserAttributes.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getUserAttributes.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAA+G;AAE/G,wDAAqD;AACrD,yFAAsF;AACtF,2GAAwG;AAEjG,MAAM,iBAAiB,GAAG,CAAO,UAAkB,EAAE,MAAc,EAAE,QAAgB,EAA2B,EAAE;IACvH,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CACvC,IAAI,sDAAmB,CAAC;QACtB,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;KACnB,CAAC,CACH,CAAC;IAEF,OAAO,IAAA,qFAAyC,EAAC,IAAA,6DAA6B,EAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;AAC3G,CAAC,CAAA,CAAC;AAbW,QAAA,iBAAiB,qBAa5B","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { AdminGetUserCommand, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getValidCognitoUserAttributes } from './utils/getValidCognitoUserAttributes';\nimport { getQpqAttributesFromCognitoUserAttributes } from './getQpqAttributesFromCognitoUserAttributes';\n\nexport const getUserAttributes = async (userPoolId: string, region: string, username: string): Promise<UserAttributes> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response = await cognitoClient.send(\n    new AdminGetUserCommand({\n      UserPoolId: userPoolId,\n      Username: username,\n    }),\n  );\n\n  return getQpqAttributesFromCognitoUserAttributes(getValidCognitoUserAttributes(response.UserAttributes));\n};\n"]}

package/lib/commonjs/logic/cognito/getUserAttributesBySub.js

@@ -12,7 +12,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getUserAttributesBySub = exports.UserNotFoundError = void 0;
 const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
 const createAwsClient_1 = require("../createAwsClient");
-const cognitoAttributeMap_1 = require("./cognitoAttributeMap");
+const buildCognitoUserFilter_1 = require("./utils/buildCognitoUserFilter");
+const getValidCognitoUserAttributes_1 = require("./utils/getValidCognitoUserAttributes");
+const getQpqAttributesFromCognitoUserAttributes_1 = require("./getQpqAttributesFromCognitoUserAttributes");
 // ListUsers returns an empty list rather than throwing for no match, so we throw
 // our own error with a discriminable `code` for the processor's catch to map.
 class UserNotFoundError extends Error {
@@ -23,20 +25,33 @@ class UserNotFoundError extends Error {
     }
 }
 exports.UserNotFoundError = UserNotFoundError;
+// A sub that cannot be embedded in a Cognito filter cannot belong to any user,
+// so unsafe input resolves to not-found instead of reaching Cognito.
+const buildSubFilter = (sub) => {
+    try {
+        return (0, buildCognitoUserFilter_1.buildCognitoUserFilter)('sub', sub);
+    }
+    catch (error) {
+        if (error instanceof buildCognitoUserFilter_1.InvalidCognitoFilterError) {
+            throw new UserNotFoundError();
+        }
+        throw error;
+    }
+};
 const getUserAttributesBySub = (userPoolId, region, sub) => __awaiter(void 0, void 0, void 0, function* () {
+    const filter = buildSubFilter(sub);
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
         region,
     });
     const response = yield cognitoClient.send(new client_cognito_identity_provider_1.ListUsersCommand({
         UserPoolId: userPoolId,
-        Filter: `sub = "${sub}"`,
+        Filter: filter,
     }));
     const [user] = (response === null || response === void 0 ? void 0 : response.Users) || [];
     if (!user) {
         throw new UserNotFoundError();
     }
-    const validAttributes = (user.Attributes || []).filter((attr) => attr.Name && attr.Value);
-    return (0, cognitoAttributeMap_1.getQpqAttributesFromCognitoUserAttributes)(validAttributes);
+    return (0, getQpqAttributesFromCognitoUserAttributes_1.getQpqAttributesFromCognitoUserAttributes)((0, getValidCognitoUserAttributes_1.getValidCognitoUserAttributes)(user.Attributes));
 });
 exports.getUserAttributesBySub = getUserAttributesBySub;
 //# sourceMappingURL=getUserAttributesBySub.js.map

package/lib/commonjs/logic/cognito/getUserAttributesBySub.js.map

@@ -1 +1 @@
-{"version":3,"file":"getUserAttributesBySub.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getUserAttributesBySub.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAA4G;AAE5G,wDAAqD;AACrD,+DAAkF;AAElF,iFAAiF;AACjF,8EAA8E;AAC9E,MAAa,iBAAkB,SAAQ,KAAK;IAG1C;QACE,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAHjB,SAAI,GAAG,gBAAgB,CAAC;QAI/B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAPD,8CAOC;AAEM,MAAM,sBAAsB,GAAG,CAAO,UAAkB,EAAE,MAAc,EAAE,GAAW,EAA2B,EAAE;IACvH,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CACvC,IAAI,mDAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,MAAM,EAAE,UAAU,GAAG,GAAG;KACzB,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,KAAK,KAAI,EAAE,CAAC;IACrC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAGrF,CAAC;IAEJ,OAAO,IAAA,+DAAyC,EAAC,eAAe,CAAC,CAAC;AACpE,CAAC,CAAA,CAAC;AAvBW,QAAA,sBAAsB,0BAuBjC","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getQpqAttributesFromCognitoUserAttributes } from './cognitoAttributeMap';\n\n// ListUsers returns an empty list rather than throwing for no match, so we throw\n// our own error with a discriminable `code` for the processor's catch to map.\nexport class UserNotFoundError extends Error {\n  readonly code = 'USER_NOT_FOUND';\n\n  constructor() {\n    super('User not found');\n    this.name = 'UserNotFoundError';\n  }\n}\n\nexport const getUserAttributesBySub = async (userPoolId: string, region: string, sub: string): Promise<UserAttributes> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      Filter: `sub = \"${sub}\"`,\n    }),\n  );\n\n  const [user] = response?.Users || [];\n  if (!user) {\n    throw new UserNotFoundError();\n  }\n\n  const validAttributes = (user.Attributes || []).filter((attr) => attr.Name && attr.Value) as {\n    Name: string;\n    Value: string;\n  }[];\n\n  return getQpqAttributesFromCognitoUserAttributes(validAttributes);\n};\n"]}
+{"version":3,"file":"getUserAttributesBySub.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getUserAttributesBySub.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAA4G;AAE5G,wDAAqD;AACrD,2EAAmG;AACnG,yFAAsF;AACtF,2GAAwG;AAExG,iFAAiF;AACjF,8EAA8E;AAC9E,MAAa,iBAAkB,SAAQ,KAAK;IAG1C;QACE,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAHjB,SAAI,GAAG,gBAAgB,CAAC;QAI/B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAPD,8CAOC;AAED,+EAA+E;AAC/E,qEAAqE;AACrE,MAAM,cAAc,GAAG,CAAC,GAAW,EAAU,EAAE;IAC7C,IAAI,CAAC;QACH,OAAO,IAAA,+CAAsB,EAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,kDAAyB,EAAE,CAAC;YAC/C,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAChC,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEK,MAAM,sBAAsB,GAAG,CAAO,UAAkB,EAAE,MAAc,EAAE,GAAW,EAA2B,EAAE;IACvH,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAEnC,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CACvC,IAAI,mDAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,MAAM,EAAE,MAAM;KACf,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,KAAK,KAAI,EAAE,CAAC;IACrC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAChC,CAAC;IAED,OAAO,IAAA,qFAAyC,EAAC,IAAA,6DAA6B,EAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;AACnG,CAAC,CAAA,CAAC;AApBW,QAAA,sBAAsB,0BAoBjC","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { buildCognitoUserFilter, InvalidCognitoFilterError } from './utils/buildCognitoUserFilter';\nimport { getValidCognitoUserAttributes } from './utils/getValidCognitoUserAttributes';\nimport { getQpqAttributesFromCognitoUserAttributes } from './getQpqAttributesFromCognitoUserAttributes';\n\n// ListUsers returns an empty list rather than throwing for no match, so we throw\n// our own error with a discriminable `code` for the processor's catch to map.\nexport class UserNotFoundError extends Error {\n  readonly code = 'USER_NOT_FOUND';\n\n  constructor() {\n    super('User not found');\n    this.name = 'UserNotFoundError';\n  }\n}\n\n// A sub that cannot be embedded in a Cognito filter cannot belong to any user,\n// so unsafe input resolves to not-found instead of reaching Cognito.\nconst buildSubFilter = (sub: string): string => {\n  try {\n    return buildCognitoUserFilter('sub', sub);\n  } catch (error) {\n    if (error instanceof InvalidCognitoFilterError) {\n      throw new UserNotFoundError();\n    }\n    throw error;\n  }\n};\n\nexport const getUserAttributesBySub = async (userPoolId: string, region: string, sub: string): Promise<UserAttributes> => {\n  const filter = buildSubFilter(sub);\n\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      Filter: filter,\n    }),\n  );\n\n  const [user] = response?.Users || [];\n  if (!user) {\n    throw new UserNotFoundError();\n  }\n\n  return getQpqAttributesFromCognitoUserAttributes(getValidCognitoUserAttributes(user.Attributes));\n};\n"]}

package/lib/commonjs/logic/cognito/getUserPoolClientSecret.d.ts

@@ -1 +1,9 @@
+export declare class ClientSecretNotFoundError extends Error {
+    readonly code = "CLIENT_SECRET_NOT_FOUND";
+    constructor();
+}
+/**
+ * Fetches the app client's secret (needed to compute the SECRET_HASH for auth
+ * flows). Throws ClientSecretNotFoundError when the client has no secret.
+ */
 export declare const getUserPoolClientSecret: (userPoolId: string, clientId: string, region: string) => Promise<string>;

package/lib/commonjs/logic/cognito/getUserPoolClientSecret.js

@@ -9,11 +9,25 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getUserPoolClientSecret = void 0;
+exports.getUserPoolClientSecret = exports.ClientSecretNotFoundError = void 0;
 const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
 const createAwsClient_1 = require("../createAwsClient");
+// DescribeUserPoolClient succeeds even when the app client has no secret, so a
+// missing secret is a hand-thrown, discriminable configuration error.
+class ClientSecretNotFoundError extends Error {
+    constructor() {
+        super('Can not find client secret for Cognito user pool client');
+        this.code = 'CLIENT_SECRET_NOT_FOUND';
+        this.name = 'ClientSecretNotFoundError';
+    }
+}
+exports.ClientSecretNotFoundError = ClientSecretNotFoundError;
+/**
+ * Fetches the app client's secret (needed to compute the SECRET_HASH for auth
+ * flows). Throws ClientSecretNotFoundError when the client has no secret.
+ */
 const getUserPoolClientSecret = (userPoolId, clientId, region) => __awaiter(void 0, void 0, void 0, function* () {
-    var _a, _b;
+    var _a;
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
         region,
     });
@@ -22,10 +36,11 @@ const getUserPoolClientSecret = (userPoolId, clientId, region) => __awaiter(void
         UserPoolId: userPoolId,
     };
     const response = yield cognitoClient.send(new client_cognito_identity_provider_1.DescribeUserPoolClientCommand(params));
-    if (!((_a = response.UserPoolClient) === null || _a === void 0 ? void 0 : _a.ClientSecret)) {
-        throw new Error('Can not find client secret for Cognito user pool client');
+    const clientSecret = (_a = response.UserPoolClient) === null || _a === void 0 ? void 0 : _a.ClientSecret;
+    if (!clientSecret) {
+        throw new ClientSecretNotFoundError();
     }
-    return (_b = response.UserPoolClient) === null || _b === void 0 ? void 0 : _b.ClientSecret;
+    return clientSecret;
 });
 exports.getUserPoolClientSecret = getUserPoolClientSecret;
 //# sourceMappingURL=getUserPoolClientSecret.js.map

package/lib/commonjs/logic/cognito/getUserPoolClientSecret.js.map

@@ -1 +1 @@
-{"version":3,"file":"getUserPoolClientSecret.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getUserPoolClientSecret.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gGAImD;AAEnD,wDAAqD;AAE9C,MAAM,uBAAuB,GAAG,CAAO,UAAkB,EAAE,QAAgB,EAAE,MAAc,EAAmB,EAAE;;IACrH,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAAuC;QACjD,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,UAAU;KACvB,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,gEAA6B,CAAC,MAAM,CAAC,CAAC,CAAC;IAErF,IAAI,CAAC,CAAA,MAAA,QAAQ,CAAC,cAAc,0CAAE,YAAY,CAAA,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,MAAA,QAAQ,CAAC,cAAc,0CAAE,YAAY,CAAC;AAC/C,CAAC,CAAA,CAAC;AAjBW,QAAA,uBAAuB,2BAiBlC","sourcesContent":["import {\n  CognitoIdentityProviderClient,\n  DescribeUserPoolClientCommand,\n  DescribeUserPoolClientCommandInput,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\n\nexport const getUserPoolClientSecret = async (userPoolId: string, clientId: string, region: string): Promise<string> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params: DescribeUserPoolClientCommandInput = {\n    ClientId: clientId,\n    UserPoolId: userPoolId,\n  };\n\n  const response = await cognitoClient.send(new DescribeUserPoolClientCommand(params));\n\n  if (!response.UserPoolClient?.ClientSecret) {\n    throw new Error('Can not find client secret for Cognito user pool client');\n  }\n\n  return response.UserPoolClient?.ClientSecret;\n};\n"]}
+{"version":3,"file":"getUserPoolClientSecret.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getUserPoolClientSecret.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gGAImD;AAEnD,wDAAqD;AAErD,+EAA+E;AAC/E,sEAAsE;AACtE,MAAa,yBAA0B,SAAQ,KAAK;IAGlD;QACE,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAH1D,SAAI,GAAG,yBAAyB,CAAC;QAIxC,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAPD,8DAOC;AAED;;;GAGG;AACI,MAAM,uBAAuB,GAAG,CAAO,UAAkB,EAAE,QAAgB,EAAE,MAAc,EAAmB,EAAE;;IACrH,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAAuC;QACjD,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,UAAU;KACvB,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,gEAA6B,CAAC,MAAM,CAAC,CAAC,CAAC;IAErF,MAAM,YAAY,GAAG,MAAA,QAAQ,CAAC,cAAc,0CAAE,YAAY,CAAC;IAC3D,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,yBAAyB,EAAE,CAAC;IACxC,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC,CAAA,CAAC;AAlBW,QAAA,uBAAuB,2BAkBlC","sourcesContent":["import {\n  CognitoIdentityProviderClient,\n  DescribeUserPoolClientCommand,\n  DescribeUserPoolClientCommandInput,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\n\n// DescribeUserPoolClient succeeds even when the app client has no secret, so a\n// missing secret is a hand-thrown, discriminable configuration error.\nexport class ClientSecretNotFoundError extends Error {\n  readonly code = 'CLIENT_SECRET_NOT_FOUND';\n\n  constructor() {\n    super('Can not find client secret for Cognito user pool client');\n    this.name = 'ClientSecretNotFoundError';\n  }\n}\n\n/**\n * Fetches the app client's secret (needed to compute the SECRET_HASH for auth\n * flows). Throws ClientSecretNotFoundError when the client has no secret.\n */\nexport const getUserPoolClientSecret = async (userPoolId: string, clientId: string, region: string): Promise<string> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params: DescribeUserPoolClientCommandInput = {\n    ClientId: clientId,\n    UserPoolId: userPoolId,\n  };\n\n  const response = await cognitoClient.send(new DescribeUserPoolClientCommand(params));\n\n  const clientSecret = response.UserPoolClient?.ClientSecret;\n  if (!clientSecret) {\n    throw new ClientSecretNotFoundError();\n  }\n\n  return clientSecret;\n};\n"]}

package/lib/commonjs/logic/cognito/index.js

@@ -14,6 +14,9 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+// Deliberately curated: this barrel is re-exported from the package root (via
+// src/logic/index.ts), so everything here is public API. Internal consumers
+// import sibling files directly; only add here to grow the public surface.
 __exportStar(require("./decodeAccessToken"), exports);
 __exportStar(require("./decodeValidJwt"), exports);
 __exportStar(require("./globalSignOut"), exports);

package/lib/commonjs/logic/cognito/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/logic/cognito/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAoC;AACpC,mDAAiC;AACjC,kDAAgC;AAChC,uDAAqC","sourcesContent":["export * from './decodeAccessToken';\nexport * from './decodeValidJwt';\nexport * from './globalSignOut';\nexport * from './revokeRefreshToken';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/logic/cognito/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,sDAAoC;AACpC,mDAAiC;AACjC,kDAAgC;AAChC,uDAAqC","sourcesContent":["// Deliberately curated: this barrel is re-exported from the package root (via\n// src/logic/index.ts), so everything here is public API. Internal consumers\n// import sibling files directly; only add here to grow the public surface.\nexport * from './decodeAccessToken';\nexport * from './decodeValidJwt';\nexport * from './globalSignOut';\nexport * from './revokeRefreshToken';\n"]}

package/lib/commonjs/logic/cognito/listPagedUsers.js

@@ -12,7 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.listPagedUsers = void 0;
 const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
 const createAwsClient_1 = require("../createAwsClient");
-const cognitoAttributeMap_1 = require("./cognitoAttributeMap");
+const getQpqAttributesFromCognitoUserAttributes_1 = require("./getQpqAttributesFromCognitoUserAttributes");
 const utils_1 = require("./utils");
 const listPagedUsers = (userPoolId, region, pageKey) => __awaiter(void 0, void 0, void 0, function* () {
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
@@ -22,13 +22,9 @@ const listPagedUsers = (userPoolId, region, pageKey) => __awaiter(void 0, void 0
         UserPoolId: userPoolId,
         PaginationToken: (0, utils_1.pageKeyToPaginationToken)(pageKey),
     }));
-    const users = (response.Users || []).map((user) => {
-        const validAttributes = (user.Attributes || []).filter((attr) => attr.Name && attr.Value);
-        return (0, cognitoAttributeMap_1.getQpqAttributesFromCognitoUserAttributes)(validAttributes);
-    });
     return {
         nextPageKey: (0, utils_1.paginationTokenToPageKey)(response.PaginationToken),
-        items: users,
+        items: (response.Users || []).map((user) => (0, getQpqAttributesFromCognitoUserAttributes_1.getQpqAttributesFromCognitoUserAttributes)((0, utils_1.getValidCognitoUserAttributes)(user.Attributes))),
     };
 });
 exports.listPagedUsers = listPagedUsers;

package/lib/commonjs/logic/cognito/listPagedUsers.js.map

@@ -1 +1 @@
-{"version":3,"file":"listPagedUsers.js","sourceRoot":"","sources":["../../../../src/logic/cognito/listPagedUsers.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAA+H;AAE/H,wDAAqD;AACrD,+DAAkF;AAClF,mCAA6E;AAEtE,MAAM,cAAc,GAAG,CAAO,UAAkB,EAAE,MAAc,EAAE,OAAgB,EAAyC,EAAE;IAClI,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAsB,MAAM,aAAa,CAAC,IAAI,CAC1D,IAAI,mDAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,eAAe,EAAE,IAAA,gCAAwB,EAAC,OAAO,CAAC;KACnD,CAAC,CACH,CAAC;IAEF,MAAM,KAAK,GAAqB,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAClE,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAGrF,CAAC;QAEJ,OAAO,IAAA,+DAAyC,EAAC,eAAe,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,WAAW,EAAE,IAAA,gCAAwB,EAAC,QAAQ,CAAC,eAAe,CAAC;QAC/D,KAAK,EAAE,KAAK;KACb,CAAC;AACJ,CAAC,CAAA,CAAC;AAzBW,QAAA,cAAc,kBAyBzB","sourcesContent":["import { QpqPagedData, UserAttributes } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ListUsersCommand, ListUsersResponse } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getQpqAttributesFromCognitoUserAttributes } from './cognitoAttributeMap';\nimport { pageKeyToPaginationToken, paginationTokenToPageKey } from './utils';\n\nexport const listPagedUsers = async (userPoolId: string, region: string, pageKey?: string): Promise<QpqPagedData<UserAttributes>> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response: ListUsersResponse = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      PaginationToken: pageKeyToPaginationToken(pageKey),\n    }),\n  );\n\n  const users: UserAttributes[] = (response.Users || []).map((user) => {\n    const validAttributes = (user.Attributes || []).filter((attr) => attr.Name && attr.Value) as {\n      Name: string;\n      Value: string;\n    }[];\n\n    return getQpqAttributesFromCognitoUserAttributes(validAttributes);\n  });\n\n  return {\n    nextPageKey: paginationTokenToPageKey(response.PaginationToken),\n    items: users,\n  };\n};\n"]}
+{"version":3,"file":"listPagedUsers.js","sourceRoot":"","sources":["../../../../src/logic/cognito/listPagedUsers.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAA4G;AAE5G,wDAAqD;AACrD,2GAAwG;AACxG,mCAA4G;AAErG,MAAM,cAAc,GAAG,CAAO,UAAkB,EAAE,MAAc,EAAE,OAAgB,EAAyC,EAAE;IAClI,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CACvC,IAAI,mDAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,eAAe,EAAE,IAAA,gCAAwB,EAAC,OAAO,CAAC;KACnD,CAAC,CACH,CAAC;IAEF,OAAO;QACL,WAAW,EAAE,IAAA,gCAAwB,EAAC,QAAQ,CAAC,eAAe,CAAC;QAC/D,KAAK,EAAE,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,qFAAyC,EAAC,IAAA,qCAA6B,EAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;KACvI,CAAC;AACJ,CAAC,CAAA,CAAC;AAhBW,QAAA,cAAc,kBAgBzB","sourcesContent":["import { QpqPagedData, UserAttributes } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getQpqAttributesFromCognitoUserAttributes } from './getQpqAttributesFromCognitoUserAttributes';\nimport { getValidCognitoUserAttributes, pageKeyToPaginationToken, paginationTokenToPageKey } from './utils';\n\nexport const listPagedUsers = async (userPoolId: string, region: string, pageKey?: string): Promise<QpqPagedData<UserAttributes>> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      PaginationToken: pageKeyToPaginationToken(pageKey),\n    }),\n  );\n\n  return {\n    nextPageKey: paginationTokenToPageKey(response.PaginationToken),\n    items: (response.Users || []).map((user) => getQpqAttributesFromCognitoUserAttributes(getValidCognitoUserAttributes(user.Attributes))),\n  };\n};\n"]}

package/lib/commonjs/logic/cognito/listPagedUsersByAttribute.d.ts

@@ -1,2 +1,7 @@
 import { QpqPagedData, UserAttributes } from 'quidproquo-core';
+/**
+ * Lists users whose attribute exactly matches the given value.
+ * Throws InvalidCognitoFilterError (code INVALID_COGNITO_FILTER) when the
+ * attribute name or value cannot be embedded safely in a Cognito filter.
+ */
 export declare const listPagedUsersByAttribute: (userPoolId: string, region: string, attributeName: string, attributeValue: string, limit?: number, pageKey?: string) => Promise<QpqPagedData<UserAttributes>>;

package/lib/commonjs/logic/cognito/listPagedUsersByAttribute.js

@@ -12,8 +12,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.listPagedUsersByAttribute = void 0;
 const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
 const createAwsClient_1 = require("../createAwsClient");
-const cognitoAttributeMap_1 = require("./cognitoAttributeMap");
+const getQpqAttributesFromCognitoUserAttributes_1 = require("./getQpqAttributesFromCognitoUserAttributes");
 const utils_1 = require("./utils");
+/**
+ * Lists users whose attribute exactly matches the given value.
+ * Throws InvalidCognitoFilterError (code INVALID_COGNITO_FILTER) when the
+ * attribute name or value cannot be embedded safely in a Cognito filter.
+ */
 const listPagedUsersByAttribute = (userPoolId, region, attributeName, attributeValue, limit, pageKey) => __awaiter(void 0, void 0, void 0, function* () {
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
         region,
@@ -21,16 +26,12 @@ const listPagedUsersByAttribute = (userPoolId, region, attributeName, attributeV
     const response = yield cognitoClient.send(new client_cognito_identity_provider_1.ListUsersCommand({
         UserPoolId: userPoolId,
         Limit: limit,
-        Filter: `${attributeName} = "${attributeValue}"`,
+        Filter: (0, utils_1.buildCognitoUserFilter)(attributeName, attributeValue),
         PaginationToken: (0, utils_1.pageKeyToPaginationToken)(pageKey),
     }));
-    const users = (response.Users || []).map((user) => {
-        const validAttributes = (user.Attributes || []).filter((attr) => attr.Name && attr.Value);
-        return (0, cognitoAttributeMap_1.getQpqAttributesFromCognitoUserAttributes)(validAttributes);
-    });
     return {
         nextPageKey: (0, utils_1.paginationTokenToPageKey)(response.PaginationToken),
-        items: users,
+        items: (response.Users || []).map((user) => (0, getQpqAttributesFromCognitoUserAttributes_1.getQpqAttributesFromCognitoUserAttributes)((0, utils_1.getValidCognitoUserAttributes)(user.Attributes))),
     };
 });
 exports.listPagedUsersByAttribute = listPagedUsersByAttribute;

package/lib/commonjs/logic/cognito/listPagedUsersByAttribute.js.map

@@ -1 +1 @@
-{"version":3,"file":"listPagedUsersByAttribute.js","sourceRoot":"","sources":["../../../../src/logic/cognito/listPagedUsersByAttribute.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAA+H;AAE/H,wDAAqD;AACrD,+DAAkF;AAClF,mCAA6E;AAEtE,MAAM,yBAAyB,GAAG,CACvC,UAAkB,EAClB,MAAc,EACd,aAAqB,EACrB,cAAsB,EACtB,KAAc,EACd,OAAgB,EACuB,EAAE;IACzC,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAsB,MAAM,aAAa,CAAC,IAAI,CAC1D,IAAI,mDAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,GAAG,aAAa,OAAO,cAAc,GAAG;QAChD,eAAe,EAAE,IAAA,gCAAwB,EAAC,OAAO,CAAC;KACnD,CAAC,CACH,CAAC;IAEF,MAAM,KAAK,GAAqB,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAClE,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAGrF,CAAC;QAEJ,OAAO,IAAA,+DAAyC,EAAC,eAAe,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,WAAW,EAAE,IAAA,gCAAwB,EAAC,QAAQ,CAAC,eAAe,CAAC;QAC/D,KAAK,EAAE,KAAK;KACb,CAAC;AACJ,CAAC,CAAA,CAAC;AAlCW,QAAA,yBAAyB,6BAkCpC","sourcesContent":["import { QpqPagedData, UserAttributes } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ListUsersCommand, ListUsersResponse } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getQpqAttributesFromCognitoUserAttributes } from './cognitoAttributeMap';\nimport { pageKeyToPaginationToken, paginationTokenToPageKey } from './utils';\n\nexport const listPagedUsersByAttribute = async (\n  userPoolId: string,\n  region: string,\n  attributeName: string,\n  attributeValue: string,\n  limit?: number,\n  pageKey?: string,\n): Promise<QpqPagedData<UserAttributes>> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response: ListUsersResponse = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      Limit: limit,\n      Filter: `${attributeName} = \"${attributeValue}\"`,\n      PaginationToken: pageKeyToPaginationToken(pageKey),\n    }),\n  );\n\n  const users: UserAttributes[] = (response.Users || []).map((user) => {\n    const validAttributes = (user.Attributes || []).filter((attr) => attr.Name && attr.Value) as {\n      Name: string;\n      Value: string;\n    }[];\n\n    return getQpqAttributesFromCognitoUserAttributes(validAttributes);\n  });\n\n  return {\n    nextPageKey: paginationTokenToPageKey(response.PaginationToken),\n    items: users,\n  };\n};\n"]}
+{"version":3,"file":"listPagedUsersByAttribute.js","sourceRoot":"","sources":["../../../../src/logic/cognito/listPagedUsersByAttribute.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAA4G;AAE5G,wDAAqD;AACrD,2GAAwG;AACxG,mCAAoI;AAEpI;;;;GAIG;AACI,MAAM,yBAAyB,GAAG,CACvC,UAAkB,EAClB,MAAc,EACd,aAAqB,EACrB,cAAsB,EACtB,KAAc,EACd,OAAgB,EACuB,EAAE;IACzC,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CACvC,IAAI,mDAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,IAAA,8BAAsB,EAAC,aAAa,EAAE,cAAc,CAAC;QAC7D,eAAe,EAAE,IAAA,gCAAwB,EAAC,OAAO,CAAC;KACnD,CAAC,CACH,CAAC;IAEF,OAAO;QACL,WAAW,EAAE,IAAA,gCAAwB,EAAC,QAAQ,CAAC,eAAe,CAAC;QAC/D,KAAK,EAAE,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,qFAAyC,EAAC,IAAA,qCAA6B,EAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;KACvI,CAAC;AACJ,CAAC,CAAA,CAAC;AAzBW,QAAA,yBAAyB,6BAyBpC","sourcesContent":["import { QpqPagedData, UserAttributes } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getQpqAttributesFromCognitoUserAttributes } from './getQpqAttributesFromCognitoUserAttributes';\nimport { buildCognitoUserFilter, getValidCognitoUserAttributes, pageKeyToPaginationToken, paginationTokenToPageKey } from './utils';\n\n/**\n * Lists users whose attribute exactly matches the given value.\n * Throws InvalidCognitoFilterError (code INVALID_COGNITO_FILTER) when the\n * attribute name or value cannot be embedded safely in a Cognito filter.\n */\nexport const listPagedUsersByAttribute = async (\n  userPoolId: string,\n  region: string,\n  attributeName: string,\n  attributeValue: string,\n  limit?: number,\n  pageKey?: string,\n): Promise<QpqPagedData<UserAttributes>> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      Limit: limit,\n      Filter: buildCognitoUserFilter(attributeName, attributeValue),\n      PaginationToken: pageKeyToPaginationToken(pageKey),\n    }),\n  );\n\n  return {\n    nextPageKey: paginationTokenToPageKey(response.PaginationToken),\n    items: (response.Users || []).map((user) => getQpqAttributesFromCognitoUserAttributes(getValidCognitoUserAttributes(user.Attributes))),\n  };\n};\n"]}

package/lib/commonjs/logic/cognito/refreshToken.js

@@ -13,7 +13,7 @@ exports.refreshToken = void 0;
 const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
 const createAwsClient_1 = require("../createAwsClient");
 const calculateSecretHash_1 = require("./utils/calculateSecretHash");
-const transformCognitoResponse_1 = require("./utils/transformCognitoResponse");
+const cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo_1 = require("./utils/cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo");
 const getUserPoolClientSecret_1 = require("./getUserPoolClientSecret");
 const refreshToken = (userPoolId, clientId, region, username, refreshToken) => __awaiter(void 0, void 0, void 0, function* () {
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
@@ -30,15 +30,16 @@ const refreshToken = (userPoolId, clientId, region, username, refreshToken) => _
             SECRET_HASH: secretHash,
         },
     };
-    // Time we issued the request
+    // Token expiry is computed relative to this; captured before the call so the
+    // derived expiresAt errs early rather than late.
     const issueDateTime = new Date().toISOString();
     const response = yield cognitoClient.send(new client_cognito_identity_provider_1.AdminInitiateAuthCommand(params));
-    const authResponse = (0, transformCognitoResponse_1.cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo)(response, issueDateTime);
-    // Cognito's REFRESH_TOKEN_AUTH flow does NOT return a refresh token — the existing one stays
-    // valid and is reused — so AuthenticationResult.RefreshToken is undefined here. Carry the
-    // caller's refresh token forward so the client keeps a usable session; without this it's
-    // dropped after the first refresh and the session can never refresh again. (If refresh-token
-    // rotation is ever enabled, Cognito DOES return a new one — then we keep that instead.)
+    const authResponse = (0, cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo_1.cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo)(response, issueDateTime);
+    // With rotation disabled, Cognito's REFRESH_TOKEN_AUTH flow does not return a
+    // refresh token: the existing one stays valid and is reused. Carry the caller's
+    // token forward so the client keeps a usable session; without this it is dropped
+    // after the first refresh and the session can never refresh again. If rotation
+    // is ever enabled Cognito does return a new token, and that one wins.
     if (authResponse.authenticationInfo && !authResponse.authenticationInfo.refreshToken) {
         authResponse.authenticationInfo.refreshToken = refreshToken;
     }

package/lib/commonjs/logic/cognito/refreshToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"refreshToken.js","sourceRoot":"","sources":["../../../../src/logic/cognito/refreshToken.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAKmD;AAEnD,wDAAqD;AACrD,qEAAkE;AAClE,+EAA2G;AAC3G,uEAAoE;AAE7D,MAAM,YAAY,GAAG,CAC1B,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,QAAgB,EAChB,YAAoB,EACe,EAAE;IACrC,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,IAAA,iDAAuB,EAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,IAAA,yCAAmB,EAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAkC;QAC5C,QAAQ,EAAE,+CAAY,CAAC,kBAAkB;QACzC,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAElB,cAAc,EAAE;YACd,aAAa,EAAE,YAAY;YAC3B,WAAW,EAAE,UAAU;SACxB;KACF,CAAC;IAEF,6BAA6B;IAC7B,MAAM,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,2DAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhF,MAAM,YAAY,GAAG,IAAA,kFAAuD,EAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAEtG,6FAA6F;IAC7F,0FAA0F;IAC1F,yFAAyF;IACzF,6FAA6F;IAC7F,wFAAwF;IACxF,IAAI,YAAY,CAAC,kBAAkB,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,YAAY,EAAE,CAAC;QACrF,YAAY,CAAC,kBAAkB,CAAC,YAAY,GAAG,YAAY,CAAC;IAC9D,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC,CAAA,CAAC;AAzCW,QAAA,YAAY,gBAyCvB","sourcesContent":["import { AuthenticateUserResponse } from 'quidproquo-core';\n\nimport {\n  AdminInitiateAuthCommand,\n  AdminInitiateAuthCommandInput,\n  AuthFlowType,\n  CognitoIdentityProviderClient,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo } from './utils/transformCognitoResponse';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\nexport const refreshToken = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  username: string,\n  refreshToken: string,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  const params: AdminInitiateAuthCommandInput = {\n    AuthFlow: AuthFlowType.REFRESH_TOKEN_AUTH,\n    UserPoolId: userPoolId,\n    ClientId: clientId,\n\n    AuthParameters: {\n      REFRESH_TOKEN: refreshToken,\n      SECRET_HASH: secretHash,\n    },\n  };\n\n  // Time we issued the request\n  const issueDateTime = new Date().toISOString();\n  const response = await cognitoClient.send(new AdminInitiateAuthCommand(params));\n\n  const authResponse = cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo(response, issueDateTime);\n\n  // Cognito's REFRESH_TOKEN_AUTH flow does NOT return a refresh token — the existing one stays\n  // valid and is reused — so AuthenticationResult.RefreshToken is undefined here. Carry the\n  // caller's refresh token forward so the client keeps a usable session; without this it's\n  // dropped after the first refresh and the session can never refresh again. (If refresh-token\n  // rotation is ever enabled, Cognito DOES return a new one — then we keep that instead.)\n  if (authResponse.authenticationInfo && !authResponse.authenticationInfo.refreshToken) {\n    authResponse.authenticationInfo.refreshToken = refreshToken;\n  }\n\n  return authResponse;\n};\n"]}
+{"version":3,"file":"refreshToken.js","sourceRoot":"","sources":["../../../../src/logic/cognito/refreshToken.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAKmD;AAEnD,wDAAqD;AACrD,qEAAkE;AAClE,6IAA0I;AAC1I,uEAAoE;AAE7D,MAAM,YAAY,GAAG,CAC1B,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,QAAgB,EAChB,YAAoB,EACe,EAAE;IACrC,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,IAAA,iDAAuB,EAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,IAAA,yCAAmB,EAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAkC;QAC5C,QAAQ,EAAE,+CAAY,CAAC,kBAAkB;QACzC,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAElB,cAAc,EAAE;YACd,aAAa,EAAE,YAAY;YAC3B,WAAW,EAAE,UAAU;SACxB;KACF,CAAC;IAEF,6EAA6E;IAC7E,iDAAiD;IACjD,MAAM,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,2DAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhF,MAAM,YAAY,GAAG,IAAA,iHAAuD,EAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAEtG,8EAA8E;IAC9E,gFAAgF;IAChF,iFAAiF;IACjF,+EAA+E;IAC/E,sEAAsE;IACtE,IAAI,YAAY,CAAC,kBAAkB,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,YAAY,EAAE,CAAC;QACrF,YAAY,CAAC,kBAAkB,CAAC,YAAY,GAAG,YAAY,CAAC;IAC9D,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC,CAAA,CAAC;AA1CW,QAAA,YAAY,gBA0CvB","sourcesContent":["import { AuthenticateUserResponse } from 'quidproquo-core';\n\nimport {\n  AdminInitiateAuthCommand,\n  AdminInitiateAuthCommandInput,\n  AuthFlowType,\n  CognitoIdentityProviderClient,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo } from './utils/cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\nexport const refreshToken = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  username: string,\n  refreshToken: string,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  const params: AdminInitiateAuthCommandInput = {\n    AuthFlow: AuthFlowType.REFRESH_TOKEN_AUTH,\n    UserPoolId: userPoolId,\n    ClientId: clientId,\n\n    AuthParameters: {\n      REFRESH_TOKEN: refreshToken,\n      SECRET_HASH: secretHash,\n    },\n  };\n\n  // Token expiry is computed relative to this; captured before the call so the\n  // derived expiresAt errs early rather than late.\n  const issueDateTime = new Date().toISOString();\n  const response = await cognitoClient.send(new AdminInitiateAuthCommand(params));\n\n  const authResponse = cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo(response, issueDateTime);\n\n  // With rotation disabled, Cognito's REFRESH_TOKEN_AUTH flow does not return a\n  // refresh token: the existing one stays valid and is reused. Carry the caller's\n  // token forward so the client keeps a usable session; without this it is dropped\n  // after the first refresh and the session can never refresh again. If rotation\n  // is ever enabled Cognito does return a new token, and that one wins.\n  if (authResponse.authenticationInfo && !authResponse.authenticationInfo.refreshToken) {\n    authResponse.authenticationInfo.refreshToken = refreshToken;\n  }\n\n  return authResponse;\n};\n"]}

package/lib/commonjs/logic/cognito/requestEmailVerificationCode.js

@@ -12,22 +12,17 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.requestEmailVerificationCode = void 0;
 const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
 const createAwsClient_1 = require("../createAwsClient");
+const cognitoCodeDeliveryDetailsToQpqDeliveryDetails_1 = require("./utils/cognitoCodeDeliveryDetailsToQpqDeliveryDetails");
 const requestEmailVerificationCode = (region, accessToken) => __awaiter(void 0, void 0, void 0, function* () {
-    var _a, _b, _c;
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
         region,
     });
     const params = {
         AccessToken: accessToken,
-        AttributeName: 'email', // Request verification for the email attribute
+        AttributeName: 'email',
     };
     const response = yield cognitoClient.send(new client_cognito_identity_provider_1.GetUserAttributeVerificationCodeCommand(params));
-    const deliveryInfo = {
-        attributeName: ((_a = response.CodeDeliveryDetails) === null || _a === void 0 ? void 0 : _a.AttributeName) || 'email',
-        destination: ((_b = response.CodeDeliveryDetails) === null || _b === void 0 ? void 0 : _b.Destination) || 'unknown@email.com',
-        deliveryMedium: ((_c = response.CodeDeliveryDetails) === null || _c === void 0 ? void 0 : _c.DeliveryMedium) || 'EMAIL',
-    };
-    return deliveryInfo;
+    return (0, cognitoCodeDeliveryDetailsToQpqDeliveryDetails_1.cognitoCodeDeliveryDetailsToQpqDeliveryDetails)(response.CodeDeliveryDetails);
 });
 exports.requestEmailVerificationCode = requestEmailVerificationCode;
 //# sourceMappingURL=requestEmailVerificationCode.js.map

package/lib/commonjs/logic/cognito/requestEmailVerificationCode.js.map

@@ -1 +1 @@
-{"version":3,"file":"requestEmailVerificationCode.js","sourceRoot":"","sources":["../../../../src/logic/cognito/requestEmailVerificationCode.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAImD;AAEnD,wDAAqD;AAE9C,MAAM,4BAA4B,GAAG,CAAO,MAAc,EAAE,WAAmB,EAA0C,EAAE;;IAChI,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAAiD;QAC3D,WAAW,EAAE,WAAW;QACxB,aAAa,EAAE,OAAO,EAAE,+CAA+C;KACxE,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,0EAAuC,CAAC,MAAM,CAAC,CAAC,CAAC;IAE/F,MAAM,YAAY,GAAG;QACnB,aAAa,EAAE,CAAA,MAAA,QAAQ,CAAC,mBAAmB,0CAAE,aAAa,KAAI,OAAO;QACrE,WAAW,EAAE,CAAA,MAAA,QAAQ,CAAC,mBAAmB,0CAAE,WAAW,KAAI,mBAAmB;QAC7E,cAAc,EAAE,CAAA,MAAA,QAAQ,CAAC,mBAAmB,0CAAE,cAAc,KAAI,OAAO;KACvC,CAAC;IAEnC,OAAO,YAAY,CAAC;AACtB,CAAC,CAAA,CAAC;AAnBW,QAAA,4BAA4B,gCAmBvC","sourcesContent":["import { AuthenticationDeliveryDetails } from 'quidproquo-core';\n\nimport {\n  CognitoIdentityProviderClient,\n  GetUserAttributeVerificationCodeCommand,\n  GetUserAttributeVerificationCodeCommandInput,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\n\nexport const requestEmailVerificationCode = async (region: string, accessToken: string): Promise<AuthenticationDeliveryDetails> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params: GetUserAttributeVerificationCodeCommandInput = {\n    AccessToken: accessToken,\n    AttributeName: 'email', // Request verification for the email attribute\n  };\n\n  const response = await cognitoClient.send(new GetUserAttributeVerificationCodeCommand(params));\n\n  const deliveryInfo = {\n    attributeName: response.CodeDeliveryDetails?.AttributeName || 'email',\n    destination: response.CodeDeliveryDetails?.Destination || 'unknown@email.com',\n    deliveryMedium: response.CodeDeliveryDetails?.DeliveryMedium || 'EMAIL',\n  } as AuthenticationDeliveryDetails;\n\n  return deliveryInfo;\n};\n"]}
+{"version":3,"file":"requestEmailVerificationCode.js","sourceRoot":"","sources":["../../../../src/logic/cognito/requestEmailVerificationCode.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAImD;AAEnD,wDAAqD;AACrD,2HAAwH;AAEjH,MAAM,4BAA4B,GAAG,CAAO,MAAc,EAAE,WAAmB,EAA0C,EAAE;IAChI,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAAiD;QAC3D,WAAW,EAAE,WAAW;QACxB,aAAa,EAAE,OAAO;KACvB,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,0EAAuC,CAAC,MAAM,CAAC,CAAC,CAAC;IAE/F,OAAO,IAAA,+FAA8C,EAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;AACtF,CAAC,CAAA,CAAC;AAbW,QAAA,4BAA4B,gCAavC","sourcesContent":["import { AuthenticationDeliveryDetails } from 'quidproquo-core';\n\nimport {\n  CognitoIdentityProviderClient,\n  GetUserAttributeVerificationCodeCommand,\n  GetUserAttributeVerificationCodeCommandInput,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { cognitoCodeDeliveryDetailsToQpqDeliveryDetails } from './utils/cognitoCodeDeliveryDetailsToQpqDeliveryDetails';\n\nexport const requestEmailVerificationCode = async (region: string, accessToken: string): Promise<AuthenticationDeliveryDetails> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params: GetUserAttributeVerificationCodeCommandInput = {\n    AccessToken: accessToken,\n    AttributeName: 'email',\n  };\n\n  const response = await cognitoClient.send(new GetUserAttributeVerificationCodeCommand(params));\n\n  return cognitoCodeDeliveryDetailsToQpqDeliveryDetails(response.CodeDeliveryDetails);\n};\n"]}

package/lib/commonjs/logic/cognito/resolveUsernameByPreferredUsername.d.ts

@@ -1 +1,6 @@
+/**
+ * Resolves a login alias (preferred_username) to the real Cognito username.
+ * Falls back to the input when nothing matches, so callers can pass either a
+ * preferred username or an actual username.
+ */
 export declare const resolveUsernameByPreferredUsername: (userPoolId: string, region: string, preferredUsername: string) => Promise<string>;

package/lib/commonjs/logic/cognito/resolveUsernameByPreferredUsername.js

@@ -12,18 +12,41 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveUsernameByPreferredUsername = void 0;
 const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
 const createAwsClient_1 = require("../createAwsClient");
+const buildCognitoUserFilter_1 = require("./utils/buildCognitoUserFilter");
+// A value that cannot be embedded in a Cognito filter cannot be anyone's
+// preferred_username, so we skip the lookup and treat the input as an actual
+// username (the same fallback as a no-match lookup).
+const buildPreferredUsernameFilter = (preferredUsername) => {
+    try {
+        return (0, buildCognitoUserFilter_1.buildCognitoUserFilter)('preferred_username', preferredUsername);
+    }
+    catch (error) {
+        if (error instanceof buildCognitoUserFilter_1.InvalidCognitoFilterError) {
+            return null;
+        }
+        throw error;
+    }
+};
+/**
+ * Resolves a login alias (preferred_username) to the real Cognito username.
+ * Falls back to the input when nothing matches, so callers can pass either a
+ * preferred username or an actual username.
+ */
 const resolveUsernameByPreferredUsername = (userPoolId, region, preferredUsername) => __awaiter(void 0, void 0, void 0, function* () {
     var _a, _b;
+    const filter = buildPreferredUsernameFilter(preferredUsername);
+    if (!filter) {
+        return preferredUsername;
+    }
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
         region,
     });
     const response = yield cognitoClient.send(new client_cognito_identity_provider_1.ListUsersCommand({
         UserPoolId: userPoolId,
         Limit: 1,
-        Filter: `preferred_username = "${preferredUsername}"`,
+        Filter: filter,
     }));
-    const resolvedUsername = (_b = (_a = response.Users) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.Username;
-    return resolvedUsername || preferredUsername;
+    return ((_b = (_a = response.Users) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.Username) || preferredUsername;
 });
 exports.resolveUsernameByPreferredUsername = resolveUsernameByPreferredUsername;
 //# sourceMappingURL=resolveUsernameByPreferredUsername.js.map

package/lib/commonjs/logic/cognito/resolveUsernameByPreferredUsername.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolveUsernameByPreferredUsername.js","sourceRoot":"","sources":["../../../../src/logic/cognito/resolveUsernameByPreferredUsername.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gGAA4G;AAE5G,wDAAqD;AAE9C,MAAM,kCAAkC,GAAG,CAAO,UAAkB,EAAE,MAAc,EAAE,iBAAyB,EAAmB,EAAE;;IACzI,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CACvC,IAAI,mDAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,yBAAyB,iBAAiB,GAAG;KACtD,CAAC,CACH,CAAC;IAEF,MAAM,gBAAgB,GAAG,MAAA,MAAA,QAAQ,CAAC,KAAK,0CAAG,CAAC,CAAC,0CAAE,QAAQ,CAAC;IAEvD,OAAO,gBAAgB,IAAI,iBAAiB,CAAC;AAC/C,CAAC,CAAA,CAAC;AAhBW,QAAA,kCAAkC,sCAgB7C","sourcesContent":["import { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\n\nexport const resolveUsernameByPreferredUsername = async (userPoolId: string, region: string, preferredUsername: string): Promise<string> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      Limit: 1,\n      Filter: `preferred_username = \"${preferredUsername}\"`,\n    }),\n  );\n\n  const resolvedUsername = response.Users?.[0]?.Username;\n\n  return resolvedUsername || preferredUsername;\n};\n"]}
+{"version":3,"file":"resolveUsernameByPreferredUsername.js","sourceRoot":"","sources":["../../../../src/logic/cognito/resolveUsernameByPreferredUsername.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gGAA4G;AAE5G,wDAAqD;AACrD,2EAAmG;AAEnG,yEAAyE;AACzE,6EAA6E;AAC7E,qDAAqD;AACrD,MAAM,4BAA4B,GAAG,CAAC,iBAAyB,EAAiB,EAAE;IAChF,IAAI,CAAC;QACH,OAAO,IAAA,+CAAsB,EAAC,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,kDAAyB,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF;;;;GAIG;AACI,MAAM,kCAAkC,GAAG,CAAO,UAAkB,EAAE,MAAc,EAAE,iBAAyB,EAAmB,EAAE;;IACzI,MAAM,MAAM,GAAG,4BAA4B,CAAC,iBAAiB,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CACvC,IAAI,mDAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,MAAM;KACf,CAAC,CACH,CAAC;IAEF,OAAO,CAAA,MAAA,MAAA,QAAQ,CAAC,KAAK,0CAAG,CAAC,CAAC,0CAAE,QAAQ,KAAI,iBAAiB,CAAC;AAC5D,CAAC,CAAA,CAAC;AAnBW,QAAA,kCAAkC,sCAmB7C","sourcesContent":["import { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { buildCognitoUserFilter, InvalidCognitoFilterError } from './utils/buildCognitoUserFilter';\n\n// A value that cannot be embedded in a Cognito filter cannot be anyone's\n// preferred_username, so we skip the lookup and treat the input as an actual\n// username (the same fallback as a no-match lookup).\nconst buildPreferredUsernameFilter = (preferredUsername: string): string | null => {\n  try {\n    return buildCognitoUserFilter('preferred_username', preferredUsername);\n  } catch (error) {\n    if (error instanceof InvalidCognitoFilterError) {\n      return null;\n    }\n    throw error;\n  }\n};\n\n/**\n * Resolves a login alias (preferred_username) to the real Cognito username.\n * Falls back to the input when nothing matches, so callers can pass either a\n * preferred username or an actual username.\n */\nexport const resolveUsernameByPreferredUsername = async (userPoolId: string, region: string, preferredUsername: string): Promise<string> => {\n  const filter = buildPreferredUsernameFilter(preferredUsername);\n  if (!filter) {\n    return preferredUsername;\n  }\n\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      Limit: 1,\n      Filter: filter,\n    }),\n  );\n\n  return response.Users?.[0]?.Username || preferredUsername;\n};\n"]}