quidproquo-actionprocessor-awslambda 0.1.11 → 0.1.12

package/lib/esm/logic/cognito/getQpqAttributeObjectFromCognitoKeyValue.js

@@ -0,0 +1,18 @@
+import { cognitoAttributeMap } from './cognitoAttributeMap';
+const reversedCognitoAttributeMap = Object.fromEntries(Object.entries(cognitoAttributeMap).map(([qpqKey, cognitoName]) => [cognitoName, qpqKey]));
+/**
+ * Maps a single Cognito attribute name/value onto a partial UserAttributes object.
+ * Names with no qpq mapping (e.g. cognito:groups) produce an empty object, and
+ * email_verified is coerced from Cognito's 'true'/'false' string to a boolean.
+ */
+export const getQpqAttributeObjectFromCognitoKeyValue = (key, value) => {
+    const userAttributeKey = reversedCognitoAttributeMap[key];
+    if (!userAttributeKey) {
+        return {};
+    }
+    if (userAttributeKey === 'emailVerified') {
+        return { emailVerified: value === 'true' };
+    }
+    return { [userAttributeKey]: value };
+};
+//# sourceMappingURL=getQpqAttributeObjectFromCognitoKeyValue.js.map

package/lib/esm/logic/cognito/getQpqAttributeObjectFromCognitoKeyValue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getQpqAttributeObjectFromCognitoKeyValue.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getQpqAttributeObjectFromCognitoKeyValue.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,MAAM,2BAA2B,GAAyC,MAAM,CAAC,WAAW,CAC1F,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,MAA8B,CAAC,CAAC,CAClH,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,GAAW,EAAE,KAAa,EAAkB,EAAE;IACrG,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAE1D,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,gBAAgB,KAAK,eAAe,EAAE,CAAC;QACzC,OAAO,EAAE,aAAa,EAAE,KAAK,KAAK,MAAM,EAAE,CAAC;IAC7C,CAAC;IAED,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC;AACvC,CAAC,CAAC","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { cognitoAttributeMap } from './cognitoAttributeMap';\n\nconst reversedCognitoAttributeMap: Record<string, keyof UserAttributes> = Object.fromEntries(\n  Object.entries(cognitoAttributeMap).map(([qpqKey, cognitoName]) => [cognitoName, qpqKey as keyof UserAttributes]),\n);\n\n/**\n * Maps a single Cognito attribute name/value onto a partial UserAttributes object.\n * Names with no qpq mapping (e.g. cognito:groups) produce an empty object, and\n * email_verified is coerced from Cognito's 'true'/'false' string to a boolean.\n */\nexport const getQpqAttributeObjectFromCognitoKeyValue = (key: string, value: string): UserAttributes => {\n  const userAttributeKey = reversedCognitoAttributeMap[key];\n\n  if (!userAttributeKey) {\n    return {};\n  }\n\n  if (userAttributeKey === 'emailVerified') {\n    return { emailVerified: value === 'true' };\n  }\n\n  return { [userAttributeKey]: value };\n};\n"]}

package/lib/esm/logic/cognito/getQpqAttributesFromCognitoStringMap.d.ts

@@ -0,0 +1,6 @@
+import { UserAttributes } from 'quidproquo-core';
+/**
+ * Maps a Cognito name-to-value record (as delivered in lambda trigger events)
+ * onto the qpq UserAttributes shape.
+ */
+export declare const getQpqAttributesFromCognitoStringMap: (cognitoUserAttributes: Record<string, string>) => UserAttributes;

package/lib/esm/logic/cognito/getQpqAttributesFromCognitoStringMap.js

@@ -0,0 +1,13 @@
+import { getQpqAttributeObjectFromCognitoKeyValue } from './getQpqAttributeObjectFromCognitoKeyValue';
+/**
+ * Maps a Cognito name-to-value record (as delivered in lambda trigger events)
+ * onto the qpq UserAttributes shape.
+ */
+export const getQpqAttributesFromCognitoStringMap = (cognitoUserAttributes) => {
+    const userAttributes = {};
+    for (const [key, value] of Object.entries(cognitoUserAttributes)) {
+        Object.assign(userAttributes, getQpqAttributeObjectFromCognitoKeyValue(key, value));
+    }
+    return userAttributes;
+};
+//# sourceMappingURL=getQpqAttributesFromCognitoStringMap.js.map

package/lib/esm/logic/cognito/getQpqAttributesFromCognitoStringMap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getQpqAttributesFromCognitoStringMap.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getQpqAttributesFromCognitoStringMap.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,wCAAwC,EAAE,MAAM,4CAA4C,CAAC;AAEtG;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,qBAA6C,EAAkB,EAAE;IACpH,MAAM,cAAc,GAAmB,EAAE,CAAC;IAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACjE,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,wCAAwC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,OAAO,cAAc,CAAC;AACxB,CAAC,CAAC","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { getQpqAttributeObjectFromCognitoKeyValue } from './getQpqAttributeObjectFromCognitoKeyValue';\n\n/**\n * Maps a Cognito name-to-value record (as delivered in lambda trigger events)\n * onto the qpq UserAttributes shape.\n */\nexport const getQpqAttributesFromCognitoStringMap = (cognitoUserAttributes: Record<string, string>): UserAttributes => {\n  const userAttributes: UserAttributes = {};\n\n  for (const [key, value] of Object.entries(cognitoUserAttributes)) {\n    Object.assign(userAttributes, getQpqAttributeObjectFromCognitoKeyValue(key, value));\n  }\n\n  return userAttributes;\n};\n"]}

package/lib/esm/logic/cognito/getQpqAttributesFromCognitoUserAttributes.d.ts

@@ -0,0 +1,4 @@
+import { UserAttributes } from 'quidproquo-core';
+import { CognitoUserAttribute } from './utils/CognitoUserAttribute';
+/** Maps a list of Cognito user attributes onto the qpq UserAttributes shape. */
+export declare const getQpqAttributesFromCognitoUserAttributes: (cognitoUserAttributes: CognitoUserAttribute[]) => UserAttributes;

package/lib/esm/logic/cognito/getQpqAttributesFromCognitoUserAttributes.js

@@ -0,0 +1,10 @@
+import { getQpqAttributeObjectFromCognitoKeyValue } from './getQpqAttributeObjectFromCognitoKeyValue';
+/** Maps a list of Cognito user attributes onto the qpq UserAttributes shape. */
+export const getQpqAttributesFromCognitoUserAttributes = (cognitoUserAttributes) => {
+    const userAttributes = {};
+    for (const { Name, Value } of cognitoUserAttributes) {
+        Object.assign(userAttributes, getQpqAttributeObjectFromCognitoKeyValue(Name, Value));
+    }
+    return userAttributes;
+};
+//# sourceMappingURL=getQpqAttributesFromCognitoUserAttributes.js.map

package/lib/esm/logic/cognito/getQpqAttributesFromCognitoUserAttributes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getQpqAttributesFromCognitoUserAttributes.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getQpqAttributesFromCognitoUserAttributes.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,wCAAwC,EAAE,MAAM,4CAA4C,CAAC;AAEtG,gFAAgF;AAChF,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,qBAA6C,EAAkB,EAAE;IACzH,MAAM,cAAc,GAAmB,EAAE,CAAC;IAE1C,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,qBAAqB,EAAE,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,wCAAwC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACvF,CAAC;IAED,OAAO,cAAc,CAAC;AACxB,CAAC,CAAC","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { CognitoUserAttribute } from './utils/CognitoUserAttribute';\nimport { getQpqAttributeObjectFromCognitoKeyValue } from './getQpqAttributeObjectFromCognitoKeyValue';\n\n/** Maps a list of Cognito user attributes onto the qpq UserAttributes shape. */\nexport const getQpqAttributesFromCognitoUserAttributes = (cognitoUserAttributes: CognitoUserAttribute[]): UserAttributes => {\n  const userAttributes: UserAttributes = {};\n\n  for (const { Name, Value } of cognitoUserAttributes) {\n    Object.assign(userAttributes, getQpqAttributeObjectFromCognitoKeyValue(Name, Value));\n  }\n\n  return userAttributes;\n};\n"]}

package/lib/esm/logic/cognito/getUserAttributes.js

@@ -1,17 +1,15 @@
 import { AdminGetUserCommand, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';
 import { createAwsClient } from '../createAwsClient';
-import { getQpqAttributesFromCognitoUserAttributes } from './cognitoAttributeMap';
+import { getValidCognitoUserAttributes } from './utils/getValidCognitoUserAttributes';
+import { getQpqAttributesFromCognitoUserAttributes } from './getQpqAttributesFromCognitoUserAttributes';
 export const getUserAttributes = async (userPoolId, region, username) => {
     const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {
         region,
     });
-    const params = {
+    const response = await cognitoClient.send(new AdminGetUserCommand({
         UserPoolId: userPoolId,
         Username: username,
-    };
-    const response = await cognitoClient.send(new AdminGetUserCommand(params));
-    const validAttributes = (response.UserAttributes || []).filter((attr) => attr.Name && attr.Value);
-    const attributes = getQpqAttributesFromCognitoUserAttributes(validAttributes);
-    return attributes;
+    }));
+    return getQpqAttributesFromCognitoUserAttributes(getValidCognitoUserAttributes(response.UserAttributes));
 };
 //# sourceMappingURL=getUserAttributes.js.map

package/lib/esm/logic/cognito/getUserAttributes.js.map

@@ -1 +1 @@
-{"version":3,"file":"getUserAttributes.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getUserAttributes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAE/G,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,yCAAyC,EAAE,MAAM,uBAAuB,CAAC;AAElF,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,UAAkB,EAAE,MAAc,EAAE,QAAgB,EAA2B,EAAE;IACvH,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;KACnB,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IAE3E,MAAM,eAAe,GAAG,CAAC,QAAQ,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAsC,CAAC;IAEvI,MAAM,UAAU,GAAG,yCAAyC,CAAC,eAAe,CAAC,CAAC;IAE9E,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { AdminGetUserCommand, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getQpqAttributesFromCognitoUserAttributes } from './cognitoAttributeMap';\n\nexport const getUserAttributes = async (userPoolId: string, region: string, username: string): Promise<UserAttributes> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params = {\n    UserPoolId: userPoolId,\n    Username: username,\n  };\n\n  const response = await cognitoClient.send(new AdminGetUserCommand(params));\n\n  const validAttributes = (response.UserAttributes || []).filter((attr) => attr.Name && attr.Value) as { Name: string; Value: string }[];\n\n  const attributes = getQpqAttributesFromCognitoUserAttributes(validAttributes);\n\n  return attributes;\n};\n"]}
+{"version":3,"file":"getUserAttributes.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getUserAttributes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAE/G,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,yCAAyC,EAAE,MAAM,6CAA6C,CAAC;AAExG,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,UAAkB,EAAE,MAAc,EAAE,QAAgB,EAA2B,EAAE;IACvH,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CACvC,IAAI,mBAAmB,CAAC;QACtB,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;KACnB,CAAC,CACH,CAAC;IAEF,OAAO,yCAAyC,CAAC,6BAA6B,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;AAC3G,CAAC,CAAC","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { AdminGetUserCommand, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getValidCognitoUserAttributes } from './utils/getValidCognitoUserAttributes';\nimport { getQpqAttributesFromCognitoUserAttributes } from './getQpqAttributesFromCognitoUserAttributes';\n\nexport const getUserAttributes = async (userPoolId: string, region: string, username: string): Promise<UserAttributes> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response = await cognitoClient.send(\n    new AdminGetUserCommand({\n      UserPoolId: userPoolId,\n      Username: username,\n    }),\n  );\n\n  return getQpqAttributesFromCognitoUserAttributes(getValidCognitoUserAttributes(response.UserAttributes));\n};\n"]}

package/lib/esm/logic/cognito/getUserAttributesBySub.js

@@ -1,6 +1,8 @@
 import { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';
 import { createAwsClient } from '../createAwsClient';
-import { getQpqAttributesFromCognitoUserAttributes } from './cognitoAttributeMap';
+import { buildCognitoUserFilter, InvalidCognitoFilterError } from './utils/buildCognitoUserFilter';
+import { getValidCognitoUserAttributes } from './utils/getValidCognitoUserAttributes';
+import { getQpqAttributesFromCognitoUserAttributes } from './getQpqAttributesFromCognitoUserAttributes';
 // ListUsers returns an empty list rather than throwing for no match, so we throw
 // our own error with a discriminable `code` for the processor's catch to map.
 export class UserNotFoundError extends Error {
@@ -10,19 +12,32 @@ export class UserNotFoundError extends Error {
         this.name = 'UserNotFoundError';
     }
 }
+// A sub that cannot be embedded in a Cognito filter cannot belong to any user,
+// so unsafe input resolves to not-found instead of reaching Cognito.
+const buildSubFilter = (sub) => {
+    try {
+        return buildCognitoUserFilter('sub', sub);
+    }
+    catch (error) {
+        if (error instanceof InvalidCognitoFilterError) {
+            throw new UserNotFoundError();
+        }
+        throw error;
+    }
+};
 export const getUserAttributesBySub = async (userPoolId, region, sub) => {
+    const filter = buildSubFilter(sub);
     const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {
         region,
     });
     const response = await cognitoClient.send(new ListUsersCommand({
         UserPoolId: userPoolId,
-        Filter: `sub = "${sub}"`,
+        Filter: filter,
     }));
     const [user] = response?.Users || [];
     if (!user) {
         throw new UserNotFoundError();
     }
-    const validAttributes = (user.Attributes || []).filter((attr) => attr.Name && attr.Value);
-    return getQpqAttributesFromCognitoUserAttributes(validAttributes);
+    return getQpqAttributesFromCognitoUserAttributes(getValidCognitoUserAttributes(user.Attributes));
 };
 //# sourceMappingURL=getUserAttributesBySub.js.map

package/lib/esm/logic/cognito/getUserAttributesBySub.js.map

@@ -1 +1 @@
-{"version":3,"file":"getUserAttributesBySub.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getUserAttributesBySub.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,6BAA6B,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAE5G,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,yCAAyC,EAAE,MAAM,uBAAuB,CAAC;AAElF,iFAAiF;AACjF,8EAA8E;AAC9E,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,GAAG,gBAAgB,CAAC;IAEjC;QACE,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EAAE,UAAkB,EAAE,MAAc,EAAE,GAAW,EAA2B,EAAE;IACvH,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CACvC,IAAI,gBAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,MAAM,EAAE,UAAU,GAAG,GAAG;KACzB,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAGrF,CAAC;IAEJ,OAAO,yCAAyC,CAAC,eAAe,CAAC,CAAC;AACpE,CAAC,CAAC","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getQpqAttributesFromCognitoUserAttributes } from './cognitoAttributeMap';\n\n// ListUsers returns an empty list rather than throwing for no match, so we throw\n// our own error with a discriminable `code` for the processor's catch to map.\nexport class UserNotFoundError extends Error {\n  readonly code = 'USER_NOT_FOUND';\n\n  constructor() {\n    super('User not found');\n    this.name = 'UserNotFoundError';\n  }\n}\n\nexport const getUserAttributesBySub = async (userPoolId: string, region: string, sub: string): Promise<UserAttributes> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      Filter: `sub = \"${sub}\"`,\n    }),\n  );\n\n  const [user] = response?.Users || [];\n  if (!user) {\n    throw new UserNotFoundError();\n  }\n\n  const validAttributes = (user.Attributes || []).filter((attr) => attr.Name && attr.Value) as {\n    Name: string;\n    Value: string;\n  }[];\n\n  return getQpqAttributesFromCognitoUserAttributes(validAttributes);\n};\n"]}
+{"version":3,"file":"getUserAttributesBySub.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getUserAttributesBySub.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,6BAA6B,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAE5G,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AACnG,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,yCAAyC,EAAE,MAAM,6CAA6C,CAAC;AAExG,iFAAiF;AACjF,8EAA8E;AAC9E,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,GAAG,gBAAgB,CAAC;IAEjC;QACE,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,+EAA+E;AAC/E,qEAAqE;AACrE,MAAM,cAAc,GAAG,CAAC,GAAW,EAAU,EAAE;IAC7C,IAAI,CAAC;QACH,OAAO,sBAAsB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;YAC/C,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAChC,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EAAE,UAAkB,EAAE,MAAc,EAAE,GAAW,EAA2B,EAAE;IACvH,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAEnC,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CACvC,IAAI,gBAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,MAAM,EAAE,MAAM;KACf,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAChC,CAAC;IAED,OAAO,yCAAyC,CAAC,6BAA6B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;AACnG,CAAC,CAAC","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { buildCognitoUserFilter, InvalidCognitoFilterError } from './utils/buildCognitoUserFilter';\nimport { getValidCognitoUserAttributes } from './utils/getValidCognitoUserAttributes';\nimport { getQpqAttributesFromCognitoUserAttributes } from './getQpqAttributesFromCognitoUserAttributes';\n\n// ListUsers returns an empty list rather than throwing for no match, so we throw\n// our own error with a discriminable `code` for the processor's catch to map.\nexport class UserNotFoundError extends Error {\n  readonly code = 'USER_NOT_FOUND';\n\n  constructor() {\n    super('User not found');\n    this.name = 'UserNotFoundError';\n  }\n}\n\n// A sub that cannot be embedded in a Cognito filter cannot belong to any user,\n// so unsafe input resolves to not-found instead of reaching Cognito.\nconst buildSubFilter = (sub: string): string => {\n  try {\n    return buildCognitoUserFilter('sub', sub);\n  } catch (error) {\n    if (error instanceof InvalidCognitoFilterError) {\n      throw new UserNotFoundError();\n    }\n    throw error;\n  }\n};\n\nexport const getUserAttributesBySub = async (userPoolId: string, region: string, sub: string): Promise<UserAttributes> => {\n  const filter = buildSubFilter(sub);\n\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      Filter: filter,\n    }),\n  );\n\n  const [user] = response?.Users || [];\n  if (!user) {\n    throw new UserNotFoundError();\n  }\n\n  return getQpqAttributesFromCognitoUserAttributes(getValidCognitoUserAttributes(user.Attributes));\n};\n"]}

package/lib/esm/logic/cognito/getUserPoolClientSecret.d.ts

@@ -1 +1,9 @@
+export declare class ClientSecretNotFoundError extends Error {
+    readonly code = "CLIENT_SECRET_NOT_FOUND";
+    constructor();
+}
+/**
+ * Fetches the app client's secret (needed to compute the SECRET_HASH for auth
+ * flows). Throws ClientSecretNotFoundError when the client has no secret.
+ */
 export declare const getUserPoolClientSecret: (userPoolId: string, clientId: string, region: string) => Promise<string>;

package/lib/esm/logic/cognito/getUserPoolClientSecret.js

@@ -1,5 +1,18 @@
 import { CognitoIdentityProviderClient, DescribeUserPoolClientCommand, } from '@aws-sdk/client-cognito-identity-provider';
 import { createAwsClient } from '../createAwsClient';
+// DescribeUserPoolClient succeeds even when the app client has no secret, so a
+// missing secret is a hand-thrown, discriminable configuration error.
+export class ClientSecretNotFoundError extends Error {
+    code = 'CLIENT_SECRET_NOT_FOUND';
+    constructor() {
+        super('Can not find client secret for Cognito user pool client');
+        this.name = 'ClientSecretNotFoundError';
+    }
+}
+/**
+ * Fetches the app client's secret (needed to compute the SECRET_HASH for auth
+ * flows). Throws ClientSecretNotFoundError when the client has no secret.
+ */
 export const getUserPoolClientSecret = async (userPoolId, clientId, region) => {
     const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {
         region,
@@ -9,9 +22,10 @@ export const getUserPoolClientSecret = async (userPoolId, clientId, region) => {
         UserPoolId: userPoolId,
     };
     const response = await cognitoClient.send(new DescribeUserPoolClientCommand(params));
-    if (!response.UserPoolClient?.ClientSecret) {
-        throw new Error('Can not find client secret for Cognito user pool client');
+    const clientSecret = response.UserPoolClient?.ClientSecret;
+    if (!clientSecret) {
+        throw new ClientSecretNotFoundError();
     }
-    return response.UserPoolClient?.ClientSecret;
+    return clientSecret;
 };
 //# sourceMappingURL=getUserPoolClientSecret.js.map

package/lib/esm/logic/cognito/getUserPoolClientSecret.js.map

@@ -1 +1 @@
-{"version":3,"file":"getUserPoolClientSecret.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getUserPoolClientSecret.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,GAE9B,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,EAAE,UAAkB,EAAE,QAAgB,EAAE,MAAc,EAAmB,EAAE;IACrH,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAAuC;QACjD,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,UAAU;KACvB,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,6BAA6B,CAAC,MAAM,CAAC,CAAC,CAAC;IAErF,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,YAAY,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC;AAC/C,CAAC,CAAC","sourcesContent":["import {\n  CognitoIdentityProviderClient,\n  DescribeUserPoolClientCommand,\n  DescribeUserPoolClientCommandInput,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\n\nexport const getUserPoolClientSecret = async (userPoolId: string, clientId: string, region: string): Promise<string> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params: DescribeUserPoolClientCommandInput = {\n    ClientId: clientId,\n    UserPoolId: userPoolId,\n  };\n\n  const response = await cognitoClient.send(new DescribeUserPoolClientCommand(params));\n\n  if (!response.UserPoolClient?.ClientSecret) {\n    throw new Error('Can not find client secret for Cognito user pool client');\n  }\n\n  return response.UserPoolClient?.ClientSecret;\n};\n"]}
+{"version":3,"file":"getUserPoolClientSecret.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getUserPoolClientSecret.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,GAE9B,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,+EAA+E;AAC/E,sEAAsE;AACtE,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,IAAI,GAAG,yBAAyB,CAAC;IAE1C;QACE,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,EAAE,UAAkB,EAAE,QAAgB,EAAE,MAAc,EAAmB,EAAE;IACrH,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAAuC;QACjD,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,UAAU;KACvB,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,6BAA6B,CAAC,MAAM,CAAC,CAAC,CAAC;IAErF,MAAM,YAAY,GAAG,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC;IAC3D,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,yBAAyB,EAAE,CAAC;IACxC,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC,CAAC","sourcesContent":["import {\n  CognitoIdentityProviderClient,\n  DescribeUserPoolClientCommand,\n  DescribeUserPoolClientCommandInput,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\n\n// DescribeUserPoolClient succeeds even when the app client has no secret, so a\n// missing secret is a hand-thrown, discriminable configuration error.\nexport class ClientSecretNotFoundError extends Error {\n  readonly code = 'CLIENT_SECRET_NOT_FOUND';\n\n  constructor() {\n    super('Can not find client secret for Cognito user pool client');\n    this.name = 'ClientSecretNotFoundError';\n  }\n}\n\n/**\n * Fetches the app client's secret (needed to compute the SECRET_HASH for auth\n * flows). Throws ClientSecretNotFoundError when the client has no secret.\n */\nexport const getUserPoolClientSecret = async (userPoolId: string, clientId: string, region: string): Promise<string> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params: DescribeUserPoolClientCommandInput = {\n    ClientId: clientId,\n    UserPoolId: userPoolId,\n  };\n\n  const response = await cognitoClient.send(new DescribeUserPoolClientCommand(params));\n\n  const clientSecret = response.UserPoolClient?.ClientSecret;\n  if (!clientSecret) {\n    throw new ClientSecretNotFoundError();\n  }\n\n  return clientSecret;\n};\n"]}

package/lib/esm/logic/cognito/index.js

@@ -1,3 +1,6 @@
+// Deliberately curated: this barrel is re-exported from the package root (via
+// src/logic/index.ts), so everything here is public API. Internal consumers
+// import sibling files directly; only add here to grow the public surface.
 export * from './decodeAccessToken';
 export * from './decodeValidJwt';
 export * from './globalSignOut';

package/lib/esm/logic/cognito/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/logic/cognito/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC","sourcesContent":["export * from './decodeAccessToken';\nexport * from './decodeValidJwt';\nexport * from './globalSignOut';\nexport * from './revokeRefreshToken';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/logic/cognito/index.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC","sourcesContent":["// Deliberately curated: this barrel is re-exported from the package root (via\n// src/logic/index.ts), so everything here is public API. Internal consumers\n// import sibling files directly; only add here to grow the public surface.\nexport * from './decodeAccessToken';\nexport * from './decodeValidJwt';\nexport * from './globalSignOut';\nexport * from './revokeRefreshToken';\n"]}

package/lib/esm/logic/cognito/listPagedUsers.js

@@ -1,7 +1,7 @@
 import { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';
 import { createAwsClient } from '../createAwsClient';
-import { getQpqAttributesFromCognitoUserAttributes } from './cognitoAttributeMap';
-import { pageKeyToPaginationToken, paginationTokenToPageKey } from './utils';
+import { getQpqAttributesFromCognitoUserAttributes } from './getQpqAttributesFromCognitoUserAttributes';
+import { getValidCognitoUserAttributes, pageKeyToPaginationToken, paginationTokenToPageKey } from './utils';
 export const listPagedUsers = async (userPoolId, region, pageKey) => {
     const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {
         region,
@@ -10,13 +10,9 @@ export const listPagedUsers = async (userPoolId, region, pageKey) => {
         UserPoolId: userPoolId,
         PaginationToken: pageKeyToPaginationToken(pageKey),
     }));
-    const users = (response.Users || []).map((user) => {
-        const validAttributes = (user.Attributes || []).filter((attr) => attr.Name && attr.Value);
-        return getQpqAttributesFromCognitoUserAttributes(validAttributes);
-    });
     return {
         nextPageKey: paginationTokenToPageKey(response.PaginationToken),
-        items: users,
+        items: (response.Users || []).map((user) => getQpqAttributesFromCognitoUserAttributes(getValidCognitoUserAttributes(user.Attributes))),
     };
 };
 //# sourceMappingURL=listPagedUsers.js.map

package/lib/esm/logic/cognito/listPagedUsers.js.map

@@ -1 +1 @@
-{"version":3,"file":"listPagedUsers.js","sourceRoot":"","sources":["../../../../src/logic/cognito/listPagedUsers.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,6BAA6B,EAAE,gBAAgB,EAAqB,MAAM,2CAA2C,CAAC;AAE/H,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,yCAAyC,EAAE,MAAM,uBAAuB,CAAC;AAClF,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAC;AAE7E,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,UAAkB,EAAE,MAAc,EAAE,OAAgB,EAAyC,EAAE;IAClI,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAsB,MAAM,aAAa,CAAC,IAAI,CAC1D,IAAI,gBAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,eAAe,EAAE,wBAAwB,CAAC,OAAO,CAAC;KACnD,CAAC,CACH,CAAC;IAEF,MAAM,KAAK,GAAqB,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAClE,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAGrF,CAAC;QAEJ,OAAO,yCAAyC,CAAC,eAAe,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,WAAW,EAAE,wBAAwB,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC/D,KAAK,EAAE,KAAK;KACb,CAAC;AACJ,CAAC,CAAC","sourcesContent":["import { QpqPagedData, UserAttributes } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ListUsersCommand, ListUsersResponse } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getQpqAttributesFromCognitoUserAttributes } from './cognitoAttributeMap';\nimport { pageKeyToPaginationToken, paginationTokenToPageKey } from './utils';\n\nexport const listPagedUsers = async (userPoolId: string, region: string, pageKey?: string): Promise<QpqPagedData<UserAttributes>> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response: ListUsersResponse = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      PaginationToken: pageKeyToPaginationToken(pageKey),\n    }),\n  );\n\n  const users: UserAttributes[] = (response.Users || []).map((user) => {\n    const validAttributes = (user.Attributes || []).filter((attr) => attr.Name && attr.Value) as {\n      Name: string;\n      Value: string;\n    }[];\n\n    return getQpqAttributesFromCognitoUserAttributes(validAttributes);\n  });\n\n  return {\n    nextPageKey: paginationTokenToPageKey(response.PaginationToken),\n    items: users,\n  };\n};\n"]}
+{"version":3,"file":"listPagedUsers.js","sourceRoot":"","sources":["../../../../src/logic/cognito/listPagedUsers.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,6BAA6B,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAE5G,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,yCAAyC,EAAE,MAAM,6CAA6C,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAC;AAE5G,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,UAAkB,EAAE,MAAc,EAAE,OAAgB,EAAyC,EAAE;IAClI,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CACvC,IAAI,gBAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,eAAe,EAAE,wBAAwB,CAAC,OAAO,CAAC;KACnD,CAAC,CACH,CAAC;IAEF,OAAO;QACL,WAAW,EAAE,wBAAwB,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC/D,KAAK,EAAE,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,yCAAyC,CAAC,6BAA6B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;KACvI,CAAC;AACJ,CAAC,CAAC","sourcesContent":["import { QpqPagedData, UserAttributes } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getQpqAttributesFromCognitoUserAttributes } from './getQpqAttributesFromCognitoUserAttributes';\nimport { getValidCognitoUserAttributes, pageKeyToPaginationToken, paginationTokenToPageKey } from './utils';\n\nexport const listPagedUsers = async (userPoolId: string, region: string, pageKey?: string): Promise<QpqPagedData<UserAttributes>> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      PaginationToken: pageKeyToPaginationToken(pageKey),\n    }),\n  );\n\n  return {\n    nextPageKey: paginationTokenToPageKey(response.PaginationToken),\n    items: (response.Users || []).map((user) => getQpqAttributesFromCognitoUserAttributes(getValidCognitoUserAttributes(user.Attributes))),\n  };\n};\n"]}

package/lib/esm/logic/cognito/listPagedUsersByAttribute.d.ts

@@ -1,2 +1,7 @@
 import { QpqPagedData, UserAttributes } from 'quidproquo-core';
+/**
+ * Lists users whose attribute exactly matches the given value.
+ * Throws InvalidCognitoFilterError (code INVALID_COGNITO_FILTER) when the
+ * attribute name or value cannot be embedded safely in a Cognito filter.
+ */
 export declare const listPagedUsersByAttribute: (userPoolId: string, region: string, attributeName: string, attributeValue: string, limit?: number, pageKey?: string) => Promise<QpqPagedData<UserAttributes>>;

package/lib/esm/logic/cognito/listPagedUsersByAttribute.js

@@ -1,7 +1,12 @@
 import { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';
 import { createAwsClient } from '../createAwsClient';
-import { getQpqAttributesFromCognitoUserAttributes } from './cognitoAttributeMap';
-import { pageKeyToPaginationToken, paginationTokenToPageKey } from './utils';
+import { getQpqAttributesFromCognitoUserAttributes } from './getQpqAttributesFromCognitoUserAttributes';
+import { buildCognitoUserFilter, getValidCognitoUserAttributes, pageKeyToPaginationToken, paginationTokenToPageKey } from './utils';
+/**
+ * Lists users whose attribute exactly matches the given value.
+ * Throws InvalidCognitoFilterError (code INVALID_COGNITO_FILTER) when the
+ * attribute name or value cannot be embedded safely in a Cognito filter.
+ */
 export const listPagedUsersByAttribute = async (userPoolId, region, attributeName, attributeValue, limit, pageKey) => {
     const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {
         region,
@@ -9,16 +14,12 @@ export const listPagedUsersByAttribute = async (userPoolId, region, attributeNam
     const response = await cognitoClient.send(new ListUsersCommand({
         UserPoolId: userPoolId,
         Limit: limit,
-        Filter: `${attributeName} = "${attributeValue}"`,
+        Filter: buildCognitoUserFilter(attributeName, attributeValue),
         PaginationToken: pageKeyToPaginationToken(pageKey),
     }));
-    const users = (response.Users || []).map((user) => {
-        const validAttributes = (user.Attributes || []).filter((attr) => attr.Name && attr.Value);
-        return getQpqAttributesFromCognitoUserAttributes(validAttributes);
-    });
     return {
         nextPageKey: paginationTokenToPageKey(response.PaginationToken),
-        items: users,
+        items: (response.Users || []).map((user) => getQpqAttributesFromCognitoUserAttributes(getValidCognitoUserAttributes(user.Attributes))),
     };
 };
 //# sourceMappingURL=listPagedUsersByAttribute.js.map

package/lib/esm/logic/cognito/listPagedUsersByAttribute.js.map

@@ -1 +1 @@
-{"version":3,"file":"listPagedUsersByAttribute.js","sourceRoot":"","sources":["../../../../src/logic/cognito/listPagedUsersByAttribute.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,6BAA6B,EAAE,gBAAgB,EAAqB,MAAM,2CAA2C,CAAC;AAE/H,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,yCAAyC,EAAE,MAAM,uBAAuB,CAAC;AAClF,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAC;AAE7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,EAC5C,UAAkB,EAClB,MAAc,EACd,aAAqB,EACrB,cAAsB,EACtB,KAAc,EACd,OAAgB,EACuB,EAAE;IACzC,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAsB,MAAM,aAAa,CAAC,IAAI,CAC1D,IAAI,gBAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,GAAG,aAAa,OAAO,cAAc,GAAG;QAChD,eAAe,EAAE,wBAAwB,CAAC,OAAO,CAAC;KACnD,CAAC,CACH,CAAC;IAEF,MAAM,KAAK,GAAqB,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAClE,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAGrF,CAAC;QAEJ,OAAO,yCAAyC,CAAC,eAAe,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,WAAW,EAAE,wBAAwB,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC/D,KAAK,EAAE,KAAK;KACb,CAAC;AACJ,CAAC,CAAC","sourcesContent":["import { QpqPagedData, UserAttributes } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ListUsersCommand, ListUsersResponse } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getQpqAttributesFromCognitoUserAttributes } from './cognitoAttributeMap';\nimport { pageKeyToPaginationToken, paginationTokenToPageKey } from './utils';\n\nexport const listPagedUsersByAttribute = async (\n  userPoolId: string,\n  region: string,\n  attributeName: string,\n  attributeValue: string,\n  limit?: number,\n  pageKey?: string,\n): Promise<QpqPagedData<UserAttributes>> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response: ListUsersResponse = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      Limit: limit,\n      Filter: `${attributeName} = \"${attributeValue}\"`,\n      PaginationToken: pageKeyToPaginationToken(pageKey),\n    }),\n  );\n\n  const users: UserAttributes[] = (response.Users || []).map((user) => {\n    const validAttributes = (user.Attributes || []).filter((attr) => attr.Name && attr.Value) as {\n      Name: string;\n      Value: string;\n    }[];\n\n    return getQpqAttributesFromCognitoUserAttributes(validAttributes);\n  });\n\n  return {\n    nextPageKey: paginationTokenToPageKey(response.PaginationToken),\n    items: users,\n  };\n};\n"]}
+{"version":3,"file":"listPagedUsersByAttribute.js","sourceRoot":"","sources":["../../../../src/logic/cognito/listPagedUsersByAttribute.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,6BAA6B,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAE5G,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,yCAAyC,EAAE,MAAM,6CAA6C,CAAC;AACxG,OAAO,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAC;AAEpI;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,EAC5C,UAAkB,EAClB,MAAc,EACd,aAAqB,EACrB,cAAsB,EACtB,KAAc,EACd,OAAgB,EACuB,EAAE;IACzC,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CACvC,IAAI,gBAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,sBAAsB,CAAC,aAAa,EAAE,cAAc,CAAC;QAC7D,eAAe,EAAE,wBAAwB,CAAC,OAAO,CAAC;KACnD,CAAC,CACH,CAAC;IAEF,OAAO;QACL,WAAW,EAAE,wBAAwB,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC/D,KAAK,EAAE,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,yCAAyC,CAAC,6BAA6B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;KACvI,CAAC;AACJ,CAAC,CAAC","sourcesContent":["import { QpqPagedData, UserAttributes } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getQpqAttributesFromCognitoUserAttributes } from './getQpqAttributesFromCognitoUserAttributes';\nimport { buildCognitoUserFilter, getValidCognitoUserAttributes, pageKeyToPaginationToken, paginationTokenToPageKey } from './utils';\n\n/**\n * Lists users whose attribute exactly matches the given value.\n * Throws InvalidCognitoFilterError (code INVALID_COGNITO_FILTER) when the\n * attribute name or value cannot be embedded safely in a Cognito filter.\n */\nexport const listPagedUsersByAttribute = async (\n  userPoolId: string,\n  region: string,\n  attributeName: string,\n  attributeValue: string,\n  limit?: number,\n  pageKey?: string,\n): Promise<QpqPagedData<UserAttributes>> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      Limit: limit,\n      Filter: buildCognitoUserFilter(attributeName, attributeValue),\n      PaginationToken: pageKeyToPaginationToken(pageKey),\n    }),\n  );\n\n  return {\n    nextPageKey: paginationTokenToPageKey(response.PaginationToken),\n    items: (response.Users || []).map((user) => getQpqAttributesFromCognitoUserAttributes(getValidCognitoUserAttributes(user.Attributes))),\n  };\n};\n"]}

package/lib/esm/logic/cognito/refreshToken.js

@@ -1,7 +1,7 @@
 import { AdminInitiateAuthCommand, AuthFlowType, CognitoIdentityProviderClient, } from '@aws-sdk/client-cognito-identity-provider';
 import { createAwsClient } from '../createAwsClient';
 import { calculateSecretHash } from './utils/calculateSecretHash';
-import { cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo } from './utils/transformCognitoResponse';
+import { cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo } from './utils/cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo';
 import { getUserPoolClientSecret } from './getUserPoolClientSecret';
 export const refreshToken = async (userPoolId, clientId, region, username, refreshToken) => {
     const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {
@@ -18,15 +18,16 @@ export const refreshToken = async (userPoolId, clientId, region, username, refre
             SECRET_HASH: secretHash,
         },
     };
-    // Time we issued the request
+    // Token expiry is computed relative to this; captured before the call so the
+    // derived expiresAt errs early rather than late.
     const issueDateTime = new Date().toISOString();
     const response = await cognitoClient.send(new AdminInitiateAuthCommand(params));
     const authResponse = cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo(response, issueDateTime);
-    // Cognito's REFRESH_TOKEN_AUTH flow does NOT return a refresh token — the existing one stays
-    // valid and is reused — so AuthenticationResult.RefreshToken is undefined here. Carry the
-    // caller's refresh token forward so the client keeps a usable session; without this it's
-    // dropped after the first refresh and the session can never refresh again. (If refresh-token
-    // rotation is ever enabled, Cognito DOES return a new one — then we keep that instead.)
+    // With rotation disabled, Cognito's REFRESH_TOKEN_AUTH flow does not return a
+    // refresh token: the existing one stays valid and is reused. Carry the caller's
+    // token forward so the client keeps a usable session; without this it is dropped
+    // after the first refresh and the session can never refresh again. If rotation
+    // is ever enabled Cognito does return a new token, and that one wins.
     if (authResponse.authenticationInfo && !authResponse.authenticationInfo.refreshToken) {
         authResponse.authenticationInfo.refreshToken = refreshToken;
     }

package/lib/esm/logic/cognito/refreshToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"refreshToken.js","sourceRoot":"","sources":["../../../../src/logic/cognito/refreshToken.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,wBAAwB,EAExB,YAAY,EACZ,6BAA6B,GAC9B,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,uDAAuD,EAAE,MAAM,kCAAkC,CAAC;AAC3G,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,QAAgB,EAChB,YAAoB,EACe,EAAE;IACrC,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAkC;QAC5C,QAAQ,EAAE,YAAY,CAAC,kBAAkB;QACzC,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAElB,cAAc,EAAE;YACd,aAAa,EAAE,YAAY;YAC3B,WAAW,EAAE,UAAU;SACxB;KACF,CAAC;IAEF,6BAA6B;IAC7B,MAAM,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhF,MAAM,YAAY,GAAG,uDAAuD,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAEtG,6FAA6F;IAC7F,0FAA0F;IAC1F,yFAAyF;IACzF,6FAA6F;IAC7F,wFAAwF;IACxF,IAAI,YAAY,CAAC,kBAAkB,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,YAAY,EAAE,CAAC;QACrF,YAAY,CAAC,kBAAkB,CAAC,YAAY,GAAG,YAAY,CAAC;IAC9D,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC,CAAC","sourcesContent":["import { AuthenticateUserResponse } from 'quidproquo-core';\n\nimport {\n  AdminInitiateAuthCommand,\n  AdminInitiateAuthCommandInput,\n  AuthFlowType,\n  CognitoIdentityProviderClient,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo } from './utils/transformCognitoResponse';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\nexport const refreshToken = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  username: string,\n  refreshToken: string,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  const params: AdminInitiateAuthCommandInput = {\n    AuthFlow: AuthFlowType.REFRESH_TOKEN_AUTH,\n    UserPoolId: userPoolId,\n    ClientId: clientId,\n\n    AuthParameters: {\n      REFRESH_TOKEN: refreshToken,\n      SECRET_HASH: secretHash,\n    },\n  };\n\n  // Time we issued the request\n  const issueDateTime = new Date().toISOString();\n  const response = await cognitoClient.send(new AdminInitiateAuthCommand(params));\n\n  const authResponse = cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo(response, issueDateTime);\n\n  // Cognito's REFRESH_TOKEN_AUTH flow does NOT return a refresh token — the existing one stays\n  // valid and is reused — so AuthenticationResult.RefreshToken is undefined here. Carry the\n  // caller's refresh token forward so the client keeps a usable session; without this it's\n  // dropped after the first refresh and the session can never refresh again. (If refresh-token\n  // rotation is ever enabled, Cognito DOES return a new one — then we keep that instead.)\n  if (authResponse.authenticationInfo && !authResponse.authenticationInfo.refreshToken) {\n    authResponse.authenticationInfo.refreshToken = refreshToken;\n  }\n\n  return authResponse;\n};\n"]}
+{"version":3,"file":"refreshToken.js","sourceRoot":"","sources":["../../../../src/logic/cognito/refreshToken.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,wBAAwB,EAExB,YAAY,EACZ,6BAA6B,GAC9B,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,uDAAuD,EAAE,MAAM,iEAAiE,CAAC;AAC1I,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,QAAgB,EAChB,YAAoB,EACe,EAAE;IACrC,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAkC;QAC5C,QAAQ,EAAE,YAAY,CAAC,kBAAkB;QACzC,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAElB,cAAc,EAAE;YACd,aAAa,EAAE,YAAY;YAC3B,WAAW,EAAE,UAAU;SACxB;KACF,CAAC;IAEF,6EAA6E;IAC7E,iDAAiD;IACjD,MAAM,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhF,MAAM,YAAY,GAAG,uDAAuD,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAEtG,8EAA8E;IAC9E,gFAAgF;IAChF,iFAAiF;IACjF,+EAA+E;IAC/E,sEAAsE;IACtE,IAAI,YAAY,CAAC,kBAAkB,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,YAAY,EAAE,CAAC;QACrF,YAAY,CAAC,kBAAkB,CAAC,YAAY,GAAG,YAAY,CAAC;IAC9D,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC,CAAC","sourcesContent":["import { AuthenticateUserResponse } from 'quidproquo-core';\n\nimport {\n  AdminInitiateAuthCommand,\n  AdminInitiateAuthCommandInput,\n  AuthFlowType,\n  CognitoIdentityProviderClient,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo } from './utils/cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\nexport const refreshToken = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  username: string,\n  refreshToken: string,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  const params: AdminInitiateAuthCommandInput = {\n    AuthFlow: AuthFlowType.REFRESH_TOKEN_AUTH,\n    UserPoolId: userPoolId,\n    ClientId: clientId,\n\n    AuthParameters: {\n      REFRESH_TOKEN: refreshToken,\n      SECRET_HASH: secretHash,\n    },\n  };\n\n  // Token expiry is computed relative to this; captured before the call so the\n  // derived expiresAt errs early rather than late.\n  const issueDateTime = new Date().toISOString();\n  const response = await cognitoClient.send(new AdminInitiateAuthCommand(params));\n\n  const authResponse = cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo(response, issueDateTime);\n\n  // With rotation disabled, Cognito's REFRESH_TOKEN_AUTH flow does not return a\n  // refresh token: the existing one stays valid and is reused. Carry the caller's\n  // token forward so the client keeps a usable session; without this it is dropped\n  // after the first refresh and the session can never refresh again. If rotation\n  // is ever enabled Cognito does return a new token, and that one wins.\n  if (authResponse.authenticationInfo && !authResponse.authenticationInfo.refreshToken) {\n    authResponse.authenticationInfo.refreshToken = refreshToken;\n  }\n\n  return authResponse;\n};\n"]}

package/lib/esm/logic/cognito/requestEmailVerificationCode.js

@@ -1,19 +1,15 @@
 import { CognitoIdentityProviderClient, GetUserAttributeVerificationCodeCommand, } from '@aws-sdk/client-cognito-identity-provider';
 import { createAwsClient } from '../createAwsClient';
+import { cognitoCodeDeliveryDetailsToQpqDeliveryDetails } from './utils/cognitoCodeDeliveryDetailsToQpqDeliveryDetails';
 export const requestEmailVerificationCode = async (region, accessToken) => {
     const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {
         region,
     });
     const params = {
         AccessToken: accessToken,
-        AttributeName: 'email', // Request verification for the email attribute
+        AttributeName: 'email',
     };
     const response = await cognitoClient.send(new GetUserAttributeVerificationCodeCommand(params));
-    const deliveryInfo = {
-        attributeName: response.CodeDeliveryDetails?.AttributeName || 'email',
-        destination: response.CodeDeliveryDetails?.Destination || 'unknown@email.com',
-        deliveryMedium: response.CodeDeliveryDetails?.DeliveryMedium || 'EMAIL',
-    };
-    return deliveryInfo;
+    return cognitoCodeDeliveryDetailsToQpqDeliveryDetails(response.CodeDeliveryDetails);
 };
 //# sourceMappingURL=requestEmailVerificationCode.js.map

package/lib/esm/logic/cognito/requestEmailVerificationCode.js.map

@@ -1 +1 @@
-{"version":3,"file":"requestEmailVerificationCode.js","sourceRoot":"","sources":["../../../../src/logic/cognito/requestEmailVerificationCode.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,6BAA6B,EAC7B,uCAAuC,GAExC,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,MAAc,EAAE,WAAmB,EAA0C,EAAE;IAChI,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAAiD;QAC3D,WAAW,EAAE,WAAW;QACxB,aAAa,EAAE,OAAO,EAAE,+CAA+C;KACxE,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,uCAAuC,CAAC,MAAM,CAAC,CAAC,CAAC;IAE/F,MAAM,YAAY,GAAG;QACnB,aAAa,EAAE,QAAQ,CAAC,mBAAmB,EAAE,aAAa,IAAI,OAAO;QACrE,WAAW,EAAE,QAAQ,CAAC,mBAAmB,EAAE,WAAW,IAAI,mBAAmB;QAC7E,cAAc,EAAE,QAAQ,CAAC,mBAAmB,EAAE,cAAc,IAAI,OAAO;KACvC,CAAC;IAEnC,OAAO,YAAY,CAAC;AACtB,CAAC,CAAC","sourcesContent":["import { AuthenticationDeliveryDetails } from 'quidproquo-core';\n\nimport {\n  CognitoIdentityProviderClient,\n  GetUserAttributeVerificationCodeCommand,\n  GetUserAttributeVerificationCodeCommandInput,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\n\nexport const requestEmailVerificationCode = async (region: string, accessToken: string): Promise<AuthenticationDeliveryDetails> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params: GetUserAttributeVerificationCodeCommandInput = {\n    AccessToken: accessToken,\n    AttributeName: 'email', // Request verification for the email attribute\n  };\n\n  const response = await cognitoClient.send(new GetUserAttributeVerificationCodeCommand(params));\n\n  const deliveryInfo = {\n    attributeName: response.CodeDeliveryDetails?.AttributeName || 'email',\n    destination: response.CodeDeliveryDetails?.Destination || 'unknown@email.com',\n    deliveryMedium: response.CodeDeliveryDetails?.DeliveryMedium || 'EMAIL',\n  } as AuthenticationDeliveryDetails;\n\n  return deliveryInfo;\n};\n"]}
+{"version":3,"file":"requestEmailVerificationCode.js","sourceRoot":"","sources":["../../../../src/logic/cognito/requestEmailVerificationCode.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,6BAA6B,EAC7B,uCAAuC,GAExC,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,8CAA8C,EAAE,MAAM,wDAAwD,CAAC;AAExH,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,MAAc,EAAE,WAAmB,EAA0C,EAAE;IAChI,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAAiD;QAC3D,WAAW,EAAE,WAAW;QACxB,aAAa,EAAE,OAAO;KACvB,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,uCAAuC,CAAC,MAAM,CAAC,CAAC,CAAC;IAE/F,OAAO,8CAA8C,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;AACtF,CAAC,CAAC","sourcesContent":["import { AuthenticationDeliveryDetails } from 'quidproquo-core';\n\nimport {\n  CognitoIdentityProviderClient,\n  GetUserAttributeVerificationCodeCommand,\n  GetUserAttributeVerificationCodeCommandInput,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { cognitoCodeDeliveryDetailsToQpqDeliveryDetails } from './utils/cognitoCodeDeliveryDetailsToQpqDeliveryDetails';\n\nexport const requestEmailVerificationCode = async (region: string, accessToken: string): Promise<AuthenticationDeliveryDetails> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params: GetUserAttributeVerificationCodeCommandInput = {\n    AccessToken: accessToken,\n    AttributeName: 'email',\n  };\n\n  const response = await cognitoClient.send(new GetUserAttributeVerificationCodeCommand(params));\n\n  return cognitoCodeDeliveryDetailsToQpqDeliveryDetails(response.CodeDeliveryDetails);\n};\n"]}

package/lib/esm/logic/cognito/resolveUsernameByPreferredUsername.d.ts

@@ -1 +1,6 @@
+/**
+ * Resolves a login alias (preferred_username) to the real Cognito username.
+ * Falls back to the input when nothing matches, so callers can pass either a
+ * preferred username or an actual username.
+ */
 export declare const resolveUsernameByPreferredUsername: (userPoolId: string, region: string, preferredUsername: string) => Promise<string>;

package/lib/esm/logic/cognito/resolveUsernameByPreferredUsername.js

@@ -1,15 +1,38 @@
 import { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';
 import { createAwsClient } from '../createAwsClient';
+import { buildCognitoUserFilter, InvalidCognitoFilterError } from './utils/buildCognitoUserFilter';
+// A value that cannot be embedded in a Cognito filter cannot be anyone's
+// preferred_username, so we skip the lookup and treat the input as an actual
+// username (the same fallback as a no-match lookup).
+const buildPreferredUsernameFilter = (preferredUsername) => {
+    try {
+        return buildCognitoUserFilter('preferred_username', preferredUsername);
+    }
+    catch (error) {
+        if (error instanceof InvalidCognitoFilterError) {
+            return null;
+        }
+        throw error;
+    }
+};
+/**
+ * Resolves a login alias (preferred_username) to the real Cognito username.
+ * Falls back to the input when nothing matches, so callers can pass either a
+ * preferred username or an actual username.
+ */
 export const resolveUsernameByPreferredUsername = async (userPoolId, region, preferredUsername) => {
+    const filter = buildPreferredUsernameFilter(preferredUsername);
+    if (!filter) {
+        return preferredUsername;
+    }
     const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {
         region,
     });
     const response = await cognitoClient.send(new ListUsersCommand({
         UserPoolId: userPoolId,
         Limit: 1,
-        Filter: `preferred_username = "${preferredUsername}"`,
+        Filter: filter,
     }));
-    const resolvedUsername = response.Users?.[0]?.Username;
-    return resolvedUsername || preferredUsername;
+    return response.Users?.[0]?.Username || preferredUsername;
 };
 //# sourceMappingURL=resolveUsernameByPreferredUsername.js.map

package/lib/esm/logic/cognito/resolveUsernameByPreferredUsername.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolveUsernameByPreferredUsername.js","sourceRoot":"","sources":["../../../../src/logic/cognito/resolveUsernameByPreferredUsername.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAE5G,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,CAAC,MAAM,kCAAkC,GAAG,KAAK,EAAE,UAAkB,EAAE,MAAc,EAAE,iBAAyB,EAAmB,EAAE;IACzI,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CACvC,IAAI,gBAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,yBAAyB,iBAAiB,GAAG;KACtD,CAAC,CACH,CAAC;IAEF,MAAM,gBAAgB,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;IAEvD,OAAO,gBAAgB,IAAI,iBAAiB,CAAC;AAC/C,CAAC,CAAC","sourcesContent":["import { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\n\nexport const resolveUsernameByPreferredUsername = async (userPoolId: string, region: string, preferredUsername: string): Promise<string> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      Limit: 1,\n      Filter: `preferred_username = \"${preferredUsername}\"`,\n    }),\n  );\n\n  const resolvedUsername = response.Users?.[0]?.Username;\n\n  return resolvedUsername || preferredUsername;\n};\n"]}
+{"version":3,"file":"resolveUsernameByPreferredUsername.js","sourceRoot":"","sources":["../../../../src/logic/cognito/resolveUsernameByPreferredUsername.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAE5G,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAEnG,yEAAyE;AACzE,6EAA6E;AAC7E,qDAAqD;AACrD,MAAM,4BAA4B,GAAG,CAAC,iBAAyB,EAAiB,EAAE;IAChF,IAAI,CAAC;QACH,OAAO,sBAAsB,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,KAAK,EAAE,UAAkB,EAAE,MAAc,EAAE,iBAAyB,EAAmB,EAAE;IACzI,MAAM,MAAM,GAAG,4BAA4B,CAAC,iBAAiB,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CACvC,IAAI,gBAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,MAAM;KACf,CAAC,CACH,CAAC;IAEF,OAAO,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,IAAI,iBAAiB,CAAC;AAC5D,CAAC,CAAC","sourcesContent":["import { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { buildCognitoUserFilter, InvalidCognitoFilterError } from './utils/buildCognitoUserFilter';\n\n// A value that cannot be embedded in a Cognito filter cannot be anyone's\n// preferred_username, so we skip the lookup and treat the input as an actual\n// username (the same fallback as a no-match lookup).\nconst buildPreferredUsernameFilter = (preferredUsername: string): string | null => {\n  try {\n    return buildCognitoUserFilter('preferred_username', preferredUsername);\n  } catch (error) {\n    if (error instanceof InvalidCognitoFilterError) {\n      return null;\n    }\n    throw error;\n  }\n};\n\n/**\n * Resolves a login alias (preferred_username) to the real Cognito username.\n * Falls back to the input when nothing matches, so callers can pass either a\n * preferred username or an actual username.\n */\nexport const resolveUsernameByPreferredUsername = async (userPoolId: string, region: string, preferredUsername: string): Promise<string> => {\n  const filter = buildPreferredUsernameFilter(preferredUsername);\n  if (!filter) {\n    return preferredUsername;\n  }\n\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      Limit: 1,\n      Filter: filter,\n    }),\n  );\n\n  return response.Users?.[0]?.Username || preferredUsername;\n};\n"]}

package/lib/esm/logic/cognito/respondToAuthChallenge.d.ts

@@ -0,0 +1,8 @@
+import { AuthenticateUserResponse } from 'quidproquo-core';
+import { ChallengeNameType } from '@aws-sdk/client-cognito-identity-provider';
+/**
+ * Answers a pending Cognito auth challenge (new password, TOTP code, custom
+ * challenge, ...) using the session from the previous auth step. Returns either
+ * issued tokens or the next challenge.
+ */
+export declare const respondToAuthChallenge: (userPoolId: string, clientId: string, region: string, username: string, session: string, challengeNameType: ChallengeNameType, attributes: Record<string, string>) => Promise<AuthenticateUserResponse>;

package/lib/esm/logic/cognito/{respondToAuthChallengeChallenge.js → respondToAuthChallenge.js}

@@ -1,9 +1,14 @@
 import { CognitoIdentityProviderClient, RespondToAuthChallengeCommand, } from '@aws-sdk/client-cognito-identity-provider';
 import { createAwsClient } from '../createAwsClient';
 import { calculateSecretHash } from './utils/calculateSecretHash';
-import { cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo } from './utils/transformCognitoResponse';
+import { cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo } from './utils/cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo';
 import { getUserPoolClientSecret } from './getUserPoolClientSecret';
-export const respondToAuthChallengeChallenge = async (userPoolId, clientId, region, username, session, challengeNameType, attributes) => {
+/**
+ * Answers a pending Cognito auth challenge (new password, TOTP code, custom
+ * challenge, ...) using the session from the previous auth step. Returns either
+ * issued tokens or the next challenge.
+ */
+export const respondToAuthChallenge = async (userPoolId, clientId, region, username, session, challengeNameType, attributes) => {
     const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {
         region,
     });
@@ -19,9 +24,10 @@ export const respondToAuthChallengeChallenge = async (userPoolId, clientId, regi
             ...attributes,
         },
     };
+    // Token expiry is computed relative to this; captured before the call so the
+    // derived expiresAt errs early rather than late.
     const issueDateTime = new Date().toISOString();
     const response = await cognitoClient.send(new RespondToAuthChallengeCommand(params));
-    // transform the response into your custom format, similar to your refreshToken function
     return cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo(response, issueDateTime);
 };
-//# sourceMappingURL=respondToAuthChallengeChallenge.js.map
+//# sourceMappingURL=respondToAuthChallenge.js.map

package/lib/esm/logic/cognito/respondToAuthChallenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"respondToAuthChallenge.js","sourceRoot":"","sources":["../../../../src/logic/cognito/respondToAuthChallenge.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,6BAA6B,EAC7B,6BAA6B,GAE9B,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,uDAAuD,EAAE,MAAM,iEAAiE,CAAC;AAC1I,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEpE;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EACzC,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,QAAgB,EAChB,OAAe,EACf,iBAAoC,EACpC,UAAkC,EACC,EAAE;IACrC,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAuC;QACjD,aAAa,EAAE,iBAAiB;QAChC,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,OAAO;QAChB,kBAAkB,EAAE;YAClB,QAAQ,EAAE,QAAQ;YAClB,WAAW,EAAE,UAAU;YAEvB,GAAG,UAAU;SACd;KACF,CAAC;IAEF,6EAA6E;IAC7E,iDAAiD;IACjD,MAAM,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,6BAA6B,CAAC,MAAM,CAAC,CAAC,CAAC;IAErF,OAAO,uDAAuD,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AAC1F,CAAC,CAAC","sourcesContent":["import { AuthenticateUserResponse } from 'quidproquo-core';\n\nimport {\n  ChallengeNameType,\n  CognitoIdentityProviderClient,\n  RespondToAuthChallengeCommand,\n  RespondToAuthChallengeCommandInput,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo } from './utils/cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\n/**\n * Answers a pending Cognito auth challenge (new password, TOTP code, custom\n * challenge, ...) using the session from the previous auth step. Returns either\n * issued tokens or the next challenge.\n */\nexport const respondToAuthChallenge = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  username: string,\n  session: string,\n  challengeNameType: ChallengeNameType,\n  attributes: Record<string, string>,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  const params: RespondToAuthChallengeCommandInput = {\n    ChallengeName: challengeNameType,\n    ClientId: clientId,\n    Session: session,\n    ChallengeResponses: {\n      USERNAME: username,\n      SECRET_HASH: secretHash,\n\n      ...attributes,\n    },\n  };\n\n  // Token expiry is computed relative to this; captured before the call so the\n  // derived expiresAt errs early rather than late.\n  const issueDateTime = new Date().toISOString();\n  const response = await cognitoClient.send(new RespondToAuthChallengeCommand(params));\n\n  return cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo(response, issueDateTime);\n};\n"]}

package/lib/esm/logic/cognito/setUserAttributes.js

@@ -1,16 +1,16 @@
 import { AdminUpdateUserAttributesCommand, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';
 import { createAwsClient } from '../createAwsClient';
-import { getCognitoUserAttributesFromQpqUserAttributes } from './cognitoAttributeMap';
+import { getCognitoUserAttributesFromQpqUserAttributes } from './getCognitoUserAttributesFromQpqUserAttributes';
 export const setUserAttributes = async (userPoolId, region, username, userAttributes) => {
     const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {
         region,
     });
+    // userId maps to the immutable sub attribute, so it must never be written back.
     const { userId, ...writeableUserAttributes } = userAttributes;
-    const params = {
+    await cognitoClient.send(new AdminUpdateUserAttributesCommand({
         UserPoolId: userPoolId,
         Username: username,
         UserAttributes: getCognitoUserAttributesFromQpqUserAttributes(writeableUserAttributes),
-    };
-    await cognitoClient.send(new AdminUpdateUserAttributesCommand(params));
+    }));
 };
 //# sourceMappingURL=setUserAttributes.js.map

package/lib/esm/logic/cognito/setUserAttributes.js.map

@@ -1 +1 @@
-{"version":3,"file":"setUserAttributes.js","sourceRoot":"","sources":["../../../../src/logic/cognito/setUserAttributes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gCAAgC,EAAiB,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAE3I,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,6CAA6C,EAAE,MAAM,uBAAuB,CAAC;AAEtF,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,UAAkB,EAAE,MAAc,EAAE,QAAgB,EAAE,cAA8B,EAAiB,EAAE;IAC7I,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,EAAE,MAAM,EAAE,GAAG,uBAAuB,EAAE,GAAG,cAAc,CAAC;IAE9D,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAClB,cAAc,EAAE,6CAA6C,CAAC,uBAAuB,CAAC;KACvF,CAAC;IAEF,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,gCAAgC,CAAC,MAAM,CAAC,CAAC,CAAC;AACzE,CAAC,CAAC","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { AdminUpdateUserAttributesCommand, AttributeType, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getCognitoUserAttributesFromQpqUserAttributes } from './cognitoAttributeMap';\n\nexport const setUserAttributes = async (userPoolId: string, region: string, username: string, userAttributes: UserAttributes): Promise<void> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const { userId, ...writeableUserAttributes } = userAttributes;\n\n  const params = {\n    UserPoolId: userPoolId,\n    Username: username,\n    UserAttributes: getCognitoUserAttributesFromQpqUserAttributes(writeableUserAttributes),\n  };\n\n  await cognitoClient.send(new AdminUpdateUserAttributesCommand(params));\n};\n"]}
+{"version":3,"file":"setUserAttributes.js","sourceRoot":"","sources":["../../../../src/logic/cognito/setUserAttributes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gCAAgC,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAE5H,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,6CAA6C,EAAE,MAAM,iDAAiD,CAAC;AAEhH,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,UAAkB,EAAE,MAAc,EAAE,QAAgB,EAAE,cAA8B,EAAiB,EAAE;IAC7I,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,gFAAgF;IAChF,MAAM,EAAE,MAAM,EAAE,GAAG,uBAAuB,EAAE,GAAG,cAAc,CAAC;IAE9D,MAAM,aAAa,CAAC,IAAI,CACtB,IAAI,gCAAgC,CAAC;QACnC,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAClB,cAAc,EAAE,6CAA6C,CAAC,uBAAuB,CAAC;KACvF,CAAC,CACH,CAAC;AACJ,CAAC,CAAC","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { AdminUpdateUserAttributesCommand, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getCognitoUserAttributesFromQpqUserAttributes } from './getCognitoUserAttributesFromQpqUserAttributes';\n\nexport const setUserAttributes = async (userPoolId: string, region: string, username: string, userAttributes: UserAttributes): Promise<void> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  // userId maps to the immutable sub attribute, so it must never be written back.\n  const { userId, ...writeableUserAttributes } = userAttributes;\n\n  await cognitoClient.send(\n    new AdminUpdateUserAttributesCommand({\n      UserPoolId: userPoolId,\n      Username: username,\n      UserAttributes: getCognitoUserAttributesFromQpqUserAttributes(writeableUserAttributes),\n    }),\n  );\n};\n"]}