quidproquo-actionprocessor-awslambda 0.1.11 → 0.1.12

package/lib/commonjs/logic/cognito/confirmForgotPassword.js.map

@@ -1 +1 @@
-{"version":3,"file":"confirmForgotPassword.js","sourceRoot":"","sources":["../../../../src/logic/cognito/confirmForgotPassword.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAImD;AAEnD,wDAAqD;AACrD,qEAAkE;AAClE,yDAAsD;AACtD,uEAAoE;AAE7D,MAAM,qBAAqB,GAAG,CACnC,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,IAAY,EACZ,QAAgB,EAChB,QAAgB,EACmB,EAAE;IACrC,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,IAAA,iDAAuB,EAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,IAAA,yCAAmB,EAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAsC;QAChD,QAAQ,EAAE,QAAQ;QAElB,gBAAgB,EAAE,IAAI;QACtB,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,QAAQ;KACnB,CAAC;IAEF,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,+DAA4B,CAAC,MAAM,CAAC,CAAC,CAAC;IAEnE,wBAAwB;IACxB,MAAM,YAAY,GAA6B,MAAM,IAAA,mCAAgB,EAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAE/H,OAAO,YAAY,CAAC;AACtB,CAAC,CAAA,CAAC;AA9BW,QAAA,qBAAqB,yBA8BhC","sourcesContent":["import { AuthenticateUserResponse } from 'quidproquo-core';\n\nimport {\n  CognitoIdentityProviderClient,\n  ConfirmForgotPasswordCommand,\n  ConfirmForgotPasswordCommandInput,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { authenticateUser } from './authenticateUser';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\nexport const confirmForgotPassword = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  code: string,\n  username: string,\n  password: string,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  const params: ConfirmForgotPasswordCommandInput = {\n    ClientId: clientId,\n\n    ConfirmationCode: code,\n    SecretHash: secretHash,\n    Password: password,\n    Username: username,\n  };\n\n  await cognitoClient.send(new ConfirmForgotPasswordCommand(params));\n\n  // Authenticate the user\n  const authResponse: AuthenticateUserResponse = await authenticateUser(userPoolId, clientId, region, false, username, password);\n\n  return authResponse;\n};\n"]}
+{"version":3,"file":"confirmForgotPassword.js","sourceRoot":"","sources":["../../../../src/logic/cognito/confirmForgotPassword.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAImD;AAEnD,wDAAqD;AACrD,qEAAkE;AAClE,yDAAsD;AACtD,uEAAoE;AAEpE;;;GAGG;AACI,MAAM,qBAAqB,GAAG,CACnC,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,IAAY,EACZ,QAAgB,EAChB,QAAgB,EACmB,EAAE;IACrC,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,IAAA,iDAAuB,EAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,IAAA,yCAAmB,EAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAsC;QAChD,QAAQ,EAAE,QAAQ;QAElB,gBAAgB,EAAE,IAAI;QACtB,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,QAAQ;KACnB,CAAC;IAEF,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,+DAA4B,CAAC,MAAM,CAAC,CAAC,CAAC;IAEnE,OAAO,IAAA,mCAAgB,EAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACnF,CAAC,CAAA,CAAC;AA3BW,QAAA,qBAAqB,yBA2BhC","sourcesContent":["import { AuthenticateUserResponse } from 'quidproquo-core';\n\nimport {\n  CognitoIdentityProviderClient,\n  ConfirmForgotPasswordCommand,\n  ConfirmForgotPasswordCommandInput,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { authenticateUser } from './authenticateUser';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\n/**\n * Confirms a forgot-password reset with the emailed code and new password, then\n * signs the user straight in with it.\n */\nexport const confirmForgotPassword = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  code: string,\n  username: string,\n  password: string,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  const params: ConfirmForgotPasswordCommandInput = {\n    ClientId: clientId,\n\n    ConfirmationCode: code,\n    SecretHash: secretHash,\n    Password: password,\n    Username: username,\n  };\n\n  await cognitoClient.send(new ConfirmForgotPasswordCommand(params));\n\n  return authenticateUser(userPoolId, clientId, region, false, username, password);\n};\n"]}

package/lib/commonjs/logic/cognito/createUser.d.ts

@@ -1,2 +1,6 @@
 import { AuthenticateUserResponse, CreateUserRequest } from 'quidproquo-core';
+/**
+ * Creates a Cognito user with the requested attributes, activates their password
+ * and signs them in, returning the authenticated session.
+ */
 export declare const createUser: (userPoolId: string, region: string, clientId: string, createUserRequest: CreateUserRequest) => Promise<AuthenticateUserResponse>;

package/lib/commonjs/logic/cognito/createUser.js

@@ -13,8 +13,12 @@ exports.createUser = void 0;
 const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
 const createAwsClient_1 = require("../createAwsClient");
 const authenticateUser_1 = require("./authenticateUser");
-const cognitoAttributeMap_1 = require("./cognitoAttributeMap");
+const getCognitoUserAttributesFromQpqUserAttributes_1 = require("./getCognitoUserAttributesFromQpqUserAttributes");
 const setUserPassword_1 = require("./setUserPassword");
+/**
+ * Creates a Cognito user with the requested attributes, activates their password
+ * and signs them in, returning the authenticated session.
+ */
 const createUser = (userPoolId, region, clientId, createUserRequest) => __awaiter(void 0, void 0, void 0, function* () {
     var _a;
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
@@ -25,7 +29,9 @@ const createUser = (userPoolId, region, clientId, createUserRequest) => __awaite
         Username: createUserRequest.email,
         MessageAction: client_cognito_identity_provider_1.MessageActionType.SUPPRESS, // Don't contact the user
         DesiredDeliveryMediums: [client_cognito_identity_provider_1.DeliveryMediumType.EMAIL],
-        UserAttributes: (0, cognitoAttributeMap_1.getCognitoUserAttributesFromQpqUserAttributes)(createUserRequest),
+        // createUserRequest includes password; it has no cognitoAttributeMap entry,
+        // so the mapper drops it rather than writing it as a user attribute.
+        UserAttributes: (0, getCognitoUserAttributesFromQpqUserAttributes_1.getCognitoUserAttributesFromQpqUserAttributes)(createUserRequest),
         ForceAliasCreation: false,
     };
     if (createUserRequest.phoneNumber) {
@@ -33,11 +39,8 @@ const createUser = (userPoolId, region, clientId, createUserRequest) => __awaite
     }
     const response = yield cognitoClient.send(new client_cognito_identity_provider_1.AdminCreateUserCommand(params));
     const username = ((_a = response.User) === null || _a === void 0 ? void 0 : _a.Username) || '';
-    // Set the user's password
     yield (0, setUserPassword_1.setUserPassword)(region, userPoolId, username, createUserRequest.password);
-    // Authenticate the user
-    const authResponse = yield (0, authenticateUser_1.authenticateUser)(userPoolId, clientId, region, false, username, createUserRequest.password);
-    return authResponse;
+    return (0, authenticateUser_1.authenticateUser)(userPoolId, clientId, region, false, username, createUserRequest.password);
 });
 exports.createUser = createUser;
 //# sourceMappingURL=createUser.js.map

package/lib/commonjs/logic/cognito/createUser.js.map

@@ -1 +1 @@
-{"version":3,"file":"createUser.js","sourceRoot":"","sources":["../../../../src/logic/cognito/createUser.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAMmD;AAEnD,wDAAqD;AACrD,yDAAsD;AACtD,+DAAsF;AACtF,uDAAoD;AAE7C,MAAM,UAAU,GAAG,CACxB,UAAkB,EAClB,MAAc,EACd,QAAgB,EAChB,iBAAoC,EACD,EAAE;;IACrC,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAAgC;QAC1C,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,iBAAiB,CAAC,KAAK;QACjC,aAAa,EAAE,oDAAiB,CAAC,QAAQ,EAAE,yBAAyB;QACpE,sBAAsB,EAAE,CAAC,qDAAkB,CAAC,KAAK,CAAC;QAClD,cAAc,EAAE,IAAA,mEAA6C,EAAC,iBAAiB,CAAC;QAChF,kBAAkB,EAAE,KAAK;KAC1B,CAAC;IAEF,IAAI,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,CAAC,sBAAuB,CAAC,IAAI,CAAC,qDAAkB,CAAC,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,yDAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;IAE9E,MAAM,QAAQ,GAAG,CAAA,MAAA,QAAQ,CAAC,IAAI,0CAAE,QAAQ,KAAI,EAAE,CAAC;IAE/C,0BAA0B;IAC1B,MAAM,IAAA,iCAAe,EAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAEhF,wBAAwB;IACxB,MAAM,YAAY,GAA6B,MAAM,IAAA,mCAAgB,EAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAEjJ,OAAO,YAAY,CAAC;AACtB,CAAC,CAAA,CAAC;AAlCW,QAAA,UAAU,cAkCrB","sourcesContent":["import { AuthenticateUserResponse, CreateUserRequest } from 'quidproquo-core';\n\nimport {\n  AdminCreateUserCommand,\n  AdminCreateUserCommandInput,\n  CognitoIdentityProviderClient,\n  DeliveryMediumType,\n  MessageActionType,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { authenticateUser } from './authenticateUser';\nimport { getCognitoUserAttributesFromQpqUserAttributes } from './cognitoAttributeMap';\nimport { setUserPassword } from './setUserPassword';\n\nexport const createUser = async (\n  userPoolId: string,\n  region: string,\n  clientId: string,\n  createUserRequest: CreateUserRequest,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params: AdminCreateUserCommandInput = {\n    UserPoolId: userPoolId,\n    Username: createUserRequest.email,\n    MessageAction: MessageActionType.SUPPRESS, // Don't contact the user\n    DesiredDeliveryMediums: [DeliveryMediumType.EMAIL],\n    UserAttributes: getCognitoUserAttributesFromQpqUserAttributes(createUserRequest),\n    ForceAliasCreation: false,\n  };\n\n  if (createUserRequest.phoneNumber) {\n    params.DesiredDeliveryMediums!.push(DeliveryMediumType.SMS);\n  }\n\n  const response = await cognitoClient.send(new AdminCreateUserCommand(params));\n\n  const username = response.User?.Username || '';\n\n  // Set the user's password\n  await setUserPassword(region, userPoolId, username, createUserRequest.password);\n\n  // Authenticate the user\n  const authResponse: AuthenticateUserResponse = await authenticateUser(userPoolId, clientId, region, false, username, createUserRequest.password);\n\n  return authResponse;\n};\n"]}
+{"version":3,"file":"createUser.js","sourceRoot":"","sources":["../../../../src/logic/cognito/createUser.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAMmD;AAEnD,wDAAqD;AACrD,yDAAsD;AACtD,mHAAgH;AAChH,uDAAoD;AAEpD;;;GAGG;AACI,MAAM,UAAU,GAAG,CACxB,UAAkB,EAClB,MAAc,EACd,QAAgB,EAChB,iBAAoC,EACD,EAAE;;IACrC,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAAgC;QAC1C,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,iBAAiB,CAAC,KAAK;QACjC,aAAa,EAAE,oDAAiB,CAAC,QAAQ,EAAE,yBAAyB;QACpE,sBAAsB,EAAE,CAAC,qDAAkB,CAAC,KAAK,CAAC;QAClD,4EAA4E;QAC5E,qEAAqE;QACrE,cAAc,EAAE,IAAA,6FAA6C,EAAC,iBAAiB,CAAC;QAChF,kBAAkB,EAAE,KAAK;KAC1B,CAAC;IAEF,IAAI,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,CAAC,sBAAuB,CAAC,IAAI,CAAC,qDAAkB,CAAC,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,yDAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;IAE9E,MAAM,QAAQ,GAAG,CAAA,MAAA,QAAQ,CAAC,IAAI,0CAAE,QAAQ,KAAI,EAAE,CAAC;IAE/C,MAAM,IAAA,iCAAe,EAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAEhF,OAAO,IAAA,mCAAgB,EAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AACrG,CAAC,CAAA,CAAC;AAhCW,QAAA,UAAU,cAgCrB","sourcesContent":["import { AuthenticateUserResponse, CreateUserRequest } from 'quidproquo-core';\n\nimport {\n  AdminCreateUserCommand,\n  AdminCreateUserCommandInput,\n  CognitoIdentityProviderClient,\n  DeliveryMediumType,\n  MessageActionType,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { authenticateUser } from './authenticateUser';\nimport { getCognitoUserAttributesFromQpqUserAttributes } from './getCognitoUserAttributesFromQpqUserAttributes';\nimport { setUserPassword } from './setUserPassword';\n\n/**\n * Creates a Cognito user with the requested attributes, activates their password\n * and signs them in, returning the authenticated session.\n */\nexport const createUser = async (\n  userPoolId: string,\n  region: string,\n  clientId: string,\n  createUserRequest: CreateUserRequest,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params: AdminCreateUserCommandInput = {\n    UserPoolId: userPoolId,\n    Username: createUserRequest.email,\n    MessageAction: MessageActionType.SUPPRESS, // Don't contact the user\n    DesiredDeliveryMediums: [DeliveryMediumType.EMAIL],\n    // createUserRequest includes password; it has no cognitoAttributeMap entry,\n    // so the mapper drops it rather than writing it as a user attribute.\n    UserAttributes: getCognitoUserAttributesFromQpqUserAttributes(createUserRequest),\n    ForceAliasCreation: false,\n  };\n\n  if (createUserRequest.phoneNumber) {\n    params.DesiredDeliveryMediums!.push(DeliveryMediumType.SMS);\n  }\n\n  const response = await cognitoClient.send(new AdminCreateUserCommand(params));\n\n  const username = response.User?.Username || '';\n\n  await setUserPassword(region, userPoolId, username, createUserRequest.password);\n\n  return authenticateUser(userPoolId, clientId, region, false, username, createUserRequest.password);\n};\n"]}

package/lib/commonjs/logic/cognito/decodeAccessToken.d.ts

@@ -1,2 +1,13 @@
 import { DecodedAccessToken, QPQConfig } from 'quidproquo-core';
+export declare class InvalidAccessTokenError extends Error {
+    readonly code = "INVALID_ACCESS_TOKEN";
+    constructor();
+}
+/**
+ * Decodes and verifies a Cognito access token for the given user directory,
+ * resolving the pool id from the directory's CloudFormation export. Throws
+ * InvalidAccessTokenError when the token is missing or fails verification.
+ * With ignoreExpiration, an expired but otherwise valid token is returned with
+ * wasValid false.
+ */
 export declare const decodeAccessToken: (userDirectoryName: string, qpqConfig: QPQConfig, accessToken?: string, ignoreExpiration?: boolean) => Promise<DecodedAccessToken>;

package/lib/commonjs/logic/cognito/decodeAccessToken.js

@@ -9,21 +9,40 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.decodeAccessToken = void 0;
+exports.decodeAccessToken = exports.InvalidAccessTokenError = void 0;
 const quidproquo_config_aws_1 = require("quidproquo-config-aws");
 const awsNamingUtils_1 = require("../../awsNamingUtils");
 const getExportedValue_1 = require("../cloudformation/getExportedValue");
 const decodeValidJwt_1 = require("./decodeValidJwt");
+// decodeValidJwt returns null rather than throwing, so this throw is the
+// discriminable signal callers (e.g. the SetAccessToken processor) catch to
+// produce an Unauthorized result.
+class InvalidAccessTokenError extends Error {
+    constructor() {
+        super('Unable to decode access token');
+        this.code = 'INVALID_ACCESS_TOKEN';
+        this.name = 'InvalidAccessTokenError';
+    }
+}
+exports.InvalidAccessTokenError = InvalidAccessTokenError;
+/**
+ * Decodes and verifies a Cognito access token for the given user directory,
+ * resolving the pool id from the directory's CloudFormation export. Throws
+ * InvalidAccessTokenError when the token is missing or fails verification.
+ * With ignoreExpiration, an expired but otherwise valid token is returned with
+ * wasValid false.
+ */
 const decodeAccessToken = (userDirectoryName_1, qpqConfig_1, accessToken_1, ...args_1) => __awaiter(void 0, [userDirectoryName_1, qpqConfig_1, accessToken_1, ...args_1], void 0, function* (userDirectoryName, qpqConfig, accessToken, ignoreExpiration = false) {
     const region = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
     const userPoolId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolIdFromConfig)(userDirectoryName, qpqConfig), region);
     const decodedAuthToken = yield (0, decodeValidJwt_1.decodeValidJwt)(userPoolId, region, ignoreExpiration, accessToken);
-    if (!decodedAuthToken || !(decodedAuthToken === null || decodedAuthToken === void 0 ? void 0 : decodedAuthToken.username)) {
-        throw new Error('Unable to decode access token');
+    if (!(decodedAuthToken === null || decodedAuthToken === void 0 ? void 0 : decodedAuthToken.username)) {
+        throw new InvalidAccessTokenError();
     }
+    // decodeValidJwt only enforces expiry when ignoreExpiration is false, so
+    // recheck here to report whether an ignored-expiry token was actually valid.
     const wasValid = !ignoreExpiration || decodedAuthToken.exp > Math.floor(Date.now() / 1000);
-    const decodedAccesToken = Object.assign(Object.assign({}, decodedAuthToken), { wasValid, userDirectory: userDirectoryName });
-    return decodedAccesToken;
+    return Object.assign(Object.assign({}, decodedAuthToken), { wasValid, userDirectory: userDirectoryName });
 });
 exports.decodeAccessToken = decodeAccessToken;
 //# sourceMappingURL=decodeAccessToken.js.map

package/lib/commonjs/logic/cognito/decodeAccessToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"decodeAccessToken.js","sourceRoot":"","sources":["../../../../src/logic/cognito/decodeAccessToken.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,iEAA0D;AAG1D,yDAA2E;AAC3E,yEAAsE;AACtE,qDAAkD;AAE3C,MAAM,iBAAiB,GAAG,6DAKF,EAAE,oGAJ/B,iBAAyB,EACzB,SAAoB,EACpB,WAAoB,EACpB,mBAA4B,KAAK;IAEjC,MAAM,MAAM,GAAG,yCAAiB,CAAC,gCAAgC,CAAC,SAAS,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,MAAM,IAAA,mCAAgB,EAAC,IAAA,oDAAmC,EAAC,iBAAiB,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;IAErH,MAAM,gBAAgB,GAAG,MAAM,IAAA,+BAAc,EAAC,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;IAEjG,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAA,gBAAgB,aAAhB,gBAAgB,uBAAhB,gBAAgB,CAAE,QAAQ,CAAA,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,gBAAgB,IAAI,gBAAgB,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE3F,MAAM,iBAAiB,mCAClB,gBAAgB,KAEnB,QAAQ,EACR,aAAa,EAAE,iBAAiB,GACjC,CAAC;IAEF,OAAO,iBAAiB,CAAC;AAC3B,CAAC,CAAA,CAAC;AAzBW,QAAA,iBAAiB,qBAyB5B","sourcesContent":["import { qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport { DecodedAccessToken, QPQConfig, qpqCoreUtils } from 'quidproquo-core';\n\nimport { getCFExportNameUserPoolIdFromConfig } from '../../awsNamingUtils';\nimport { getExportedValue } from '../cloudformation/getExportedValue';\nimport { decodeValidJwt } from './decodeValidJwt';\n\nexport const decodeAccessToken = async (\n  userDirectoryName: string,\n  qpqConfig: QPQConfig,\n  accessToken?: string,\n  ignoreExpiration: boolean = false,\n): Promise<DecodedAccessToken> => {\n  const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);\n  const userPoolId = await getExportedValue(getCFExportNameUserPoolIdFromConfig(userDirectoryName, qpqConfig), region);\n\n  const decodedAuthToken = await decodeValidJwt(userPoolId, region, ignoreExpiration, accessToken);\n\n  if (!decodedAuthToken || !decodedAuthToken?.username) {\n    throw new Error('Unable to decode access token');\n  }\n\n  const wasValid = !ignoreExpiration || decodedAuthToken.exp > Math.floor(Date.now() / 1000);\n\n  const decodedAccesToken: DecodedAccessToken = {\n    ...decodedAuthToken,\n\n    wasValid,\n    userDirectory: userDirectoryName,\n  };\n\n  return decodedAccesToken;\n};\n"]}
+{"version":3,"file":"decodeAccessToken.js","sourceRoot":"","sources":["../../../../src/logic/cognito/decodeAccessToken.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,iEAA0D;AAG1D,yDAA2E;AAC3E,yEAAsE;AACtE,qDAAkD;AAElD,yEAAyE;AACzE,4EAA4E;AAC5E,kCAAkC;AAClC,MAAa,uBAAwB,SAAQ,KAAK;IAGhD;QACE,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAHhC,SAAI,GAAG,sBAAsB,CAAC;QAIrC,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAPD,0DAOC;AAED;;;;;;GAMG;AACI,MAAM,iBAAiB,GAAG,6DAKF,EAAE,oGAJ/B,iBAAyB,EACzB,SAAoB,EACpB,WAAoB,EACpB,mBAA4B,KAAK;IAEjC,MAAM,MAAM,GAAG,yCAAiB,CAAC,gCAAgC,CAAC,SAAS,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,MAAM,IAAA,mCAAgB,EAAC,IAAA,oDAAmC,EAAC,iBAAiB,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;IAErH,MAAM,gBAAgB,GAAG,MAAM,IAAA,+BAAc,EAAC,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;IAEjG,IAAI,CAAC,CAAA,gBAAgB,aAAhB,gBAAgB,uBAAhB,gBAAgB,CAAE,QAAQ,CAAA,EAAE,CAAC;QAChC,MAAM,IAAI,uBAAuB,EAAE,CAAC;IACtC,CAAC;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,CAAC,gBAAgB,IAAI,gBAAgB,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE3F,uCACK,gBAAgB,KAEnB,QAAQ,EACR,aAAa,EAAE,iBAAiB,IAChC;AACJ,CAAC,CAAA,CAAC;AAzBW,QAAA,iBAAiB,qBAyB5B","sourcesContent":["import { qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport { DecodedAccessToken, QPQConfig } from 'quidproquo-core';\n\nimport { getCFExportNameUserPoolIdFromConfig } from '../../awsNamingUtils';\nimport { getExportedValue } from '../cloudformation/getExportedValue';\nimport { decodeValidJwt } from './decodeValidJwt';\n\n// decodeValidJwt returns null rather than throwing, so this throw is the\n// discriminable signal callers (e.g. the SetAccessToken processor) catch to\n// produce an Unauthorized result.\nexport class InvalidAccessTokenError extends Error {\n  readonly code = 'INVALID_ACCESS_TOKEN';\n\n  constructor() {\n    super('Unable to decode access token');\n    this.name = 'InvalidAccessTokenError';\n  }\n}\n\n/**\n * Decodes and verifies a Cognito access token for the given user directory,\n * resolving the pool id from the directory's CloudFormation export. Throws\n * InvalidAccessTokenError when the token is missing or fails verification.\n * With ignoreExpiration, an expired but otherwise valid token is returned with\n * wasValid false.\n */\nexport const decodeAccessToken = async (\n  userDirectoryName: string,\n  qpqConfig: QPQConfig,\n  accessToken?: string,\n  ignoreExpiration: boolean = false,\n): Promise<DecodedAccessToken> => {\n  const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);\n  const userPoolId = await getExportedValue(getCFExportNameUserPoolIdFromConfig(userDirectoryName, qpqConfig), region);\n\n  const decodedAuthToken = await decodeValidJwt(userPoolId, region, ignoreExpiration, accessToken);\n\n  if (!decodedAuthToken?.username) {\n    throw new InvalidAccessTokenError();\n  }\n\n  // decodeValidJwt only enforces expiry when ignoreExpiration is false, so\n  // recheck here to report whether an ignored-expiry token was actually valid.\n  const wasValid = !ignoreExpiration || decodedAuthToken.exp > Math.floor(Date.now() / 1000);\n\n  return {\n    ...decodedAuthToken,\n\n    wasValid,\n    userDirectory: userDirectoryName,\n  };\n};\n"]}

package/lib/commonjs/logic/cognito/decodeValidJwt.d.ts

@@ -1,2 +1,8 @@
-import { DecodedAccessToken } from 'quidproquo-core';
-export declare const decodeValidJwt: (userPoolId: string, region: string, ignoreExpiration: boolean, accessToken?: string) => Promise<Omit<DecodedAccessToken, "userDirectory"> | null>;
+import { DecodedAccessToken, Nullable } from 'quidproquo-core';
+/**
+ * Verifies a Cognito access token and returns its decoded qpq shape: signature is
+ * checked against the pool's JWKS (RS256 only), plus issuer, expiry (unless
+ * ignoreExpiration) and token_use. Returns null for anything that fails; failures
+ * are logged in summary form only, never the token itself.
+ */
+export declare const decodeValidJwt: (userPoolId: string, region: string, ignoreExpiration: boolean, accessToken?: string) => Promise<Nullable<Omit<DecodedAccessToken, "userDirectory">>>;

package/lib/commonjs/logic/cognito/decodeValidJwt.js

@@ -8,13 +8,16 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.decodeValidJwt = void 0;
 const jsonwebtoken_1 = require("jsonwebtoken");
-const jwks_rsa_1 = __importDefault(require("jwks-rsa"));
+const getCognitoJwksClient_1 = require("./getCognitoJwksClient");
+/**
+ * Verifies a Cognito access token and returns its decoded qpq shape: signature is
+ * checked against the pool's JWKS (RS256 only), plus issuer, expiry (unless
+ * ignoreExpiration) and token_use. Returns null for anything that fails; failures
+ * are logged in summary form only, never the token itself.
+ */
 const decodeValidJwt = (userPoolId, region, ignoreExpiration, accessToken) => __awaiter(void 0, void 0, void 0, function* () {
     if (!accessToken) {
         return null;
@@ -24,22 +27,25 @@ const decodeValidJwt = (userPoolId, region, ignoreExpiration, accessToken) => __
         if (!decodedToken) {
             return null;
         }
-        const client = (0, jwks_rsa_1.default)({
-            jwksUri: `https://cognito-idp.${region}.amazonaws.com/${userPoolId}/.well-known/jwks.json`,
-        });
+        const client = (0, getCognitoJwksClient_1.getCognitoJwksClient)(`https://cognito-idp.${region}.amazonaws.com/${userPoolId}/.well-known/jwks.json`);
         const key = yield client.getSigningKey(decodedToken.header.kid);
         const signingKey = key.getPublicKey();
         const payload = (0, jsonwebtoken_1.verify)(accessToken, signingKey, {
             algorithms: ['RS256'],
+            issuer: `https://cognito-idp.${region}.amazonaws.com/${userPoolId}`,
             ignoreExpiration,
         });
-        const decodedAccessToken = {
+        // An id token from the same pool passes signature verification too; only
+        // access tokens are acceptable here.
+        if (payload.token_use !== 'access') {
+            return null;
+        }
+        return {
             userId: payload.sub,
             username: payload.username,
             exp: payload.exp,
             wasValid: true,
         };
-        return decodedAccessToken;
     }
     catch (e) {
         const summary = e instanceof Error ? `${e.name}: ${e.message}` : 'unknown error';

package/lib/commonjs/logic/cognito/decodeValidJwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"decodeValidJwt.js","sourceRoot":"","sources":["../../../../src/logic/cognito/decodeValidJwt.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAEA,+CAA8C;AAC9C,wDAAkC;AAkB3B,MAAM,cAAc,GAAG,CAC5B,UAAkB,EAClB,MAAc,EACd,gBAAyB,EACzB,WAAoB,EACuC,EAAE;IAC7D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAA,qBAAM,EAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,kBAAU,EAAC;YACxB,OAAO,EAAE,uBAAuB,MAAM,kBAAkB,UAAU,wBAAwB;SAC3F,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;QAEtC,MAAM,OAAO,GAAG,IAAA,qBAAM,EAAC,WAAW,EAAE,UAAU,EAAE;YAC9C,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,gBAAgB;SACjB,CAAe,CAAC;QAEjB,MAAM,kBAAkB,GAA8C;YACpE,MAAM,EAAE,OAAO,CAAC,GAAG;YACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,QAAQ,EAAE,IAAI;SACf,CAAC;QAEF,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,OAAO,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAA,CAAC;AAzCW,QAAA,cAAc,kBAyCzB","sourcesContent":["import { DecodedAccessToken } from 'quidproquo-core';\n\nimport { decode, verify } from 'jsonwebtoken';\nimport jwksClient from 'jwks-rsa';\n\n// TODO: Check whey we need this? I think you should be able to get types from the lib?\ntype JwtPayload = {\n  sub: string;\n  iss: string;\n  client_id: string;\n  origin_jti: string;\n  event_id: string;\n  token_use: string;\n  scope: string;\n  auth_time: number;\n  exp: number;\n  iat: number;\n  jti: string;\n  username: string;\n};\n\nexport const decodeValidJwt = async (\n  userPoolId: string,\n  region: string,\n  ignoreExpiration: boolean,\n  accessToken?: string,\n): Promise<Omit<DecodedAccessToken, 'userDirectory'> | null> => {\n  if (!accessToken) {\n    return null;\n  }\n\n  try {\n    const decodedToken = decode(accessToken, { complete: true });\n    if (!decodedToken) {\n      return null;\n    }\n\n    const client = jwksClient({\n      jwksUri: `https://cognito-idp.${region}.amazonaws.com/${userPoolId}/.well-known/jwks.json`,\n    });\n\n    const key = await client.getSigningKey(decodedToken.header.kid);\n    const signingKey = key.getPublicKey();\n\n    const payload = verify(accessToken, signingKey, {\n      algorithms: ['RS256'],\n      ignoreExpiration,\n    }) as JwtPayload;\n\n    const decodedAccessToken: Omit<DecodedAccessToken, 'userDirectory'> = {\n      userId: payload.sub,\n      username: payload.username,\n      exp: payload.exp,\n      wasValid: true,\n    };\n\n    return decodedAccessToken;\n  } catch (e) {\n    const summary = e instanceof Error ? `${e.name}: ${e.message}` : 'unknown error';\n    console.log('Failed to decode jwt token:', summary);\n    return null;\n  }\n};\n"]}
+{"version":3,"file":"decodeValidJwt.js","sourceRoot":"","sources":["../../../../src/logic/cognito/decodeValidJwt.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,+CAA8C;AAE9C,iEAA8D;AAW9D;;;;;GAKG;AACI,MAAM,cAAc,GAAG,CAC5B,UAAkB,EAClB,MAAc,EACd,gBAAyB,EACzB,WAAoB,EAC0C,EAAE;IAChE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAA,qBAAM,EAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,2CAAoB,EAAC,uBAAuB,MAAM,kBAAkB,UAAU,wBAAwB,CAAC,CAAC;QAEvH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;QAEtC,MAAM,OAAO,GAAG,IAAA,qBAAM,EAAC,WAAW,EAAE,UAAU,EAAE;YAC9C,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,uBAAuB,MAAM,kBAAkB,UAAU,EAAE;YACnE,gBAAgB;SACjB,CAA8B,CAAC;QAEhC,yEAAyE;QACzE,qCAAqC;QACrC,IAAI,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,GAAG;YACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,QAAQ,EAAE,IAAI;SACf,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,OAAO,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAA,CAAC;AA5CW,QAAA,cAAc,kBA4CzB","sourcesContent":["import { DecodedAccessToken, Nullable } from 'quidproquo-core';\n\nimport { decode, verify } from 'jsonwebtoken';\n\nimport { getCognitoJwksClient } from './getCognitoJwksClient';\n\n// The jsonwebtoken lib types every claim as optional, so the Cognito\n// access-token claims this decoder relies on are typed here.\ntype CognitoAccessTokenPayload = {\n  sub: string;\n  token_use: string;\n  username: string;\n  exp: number;\n};\n\n/**\n * Verifies a Cognito access token and returns its decoded qpq shape: signature is\n * checked against the pool's JWKS (RS256 only), plus issuer, expiry (unless\n * ignoreExpiration) and token_use. Returns null for anything that fails; failures\n * are logged in summary form only, never the token itself.\n */\nexport const decodeValidJwt = async (\n  userPoolId: string,\n  region: string,\n  ignoreExpiration: boolean,\n  accessToken?: string,\n): Promise<Nullable<Omit<DecodedAccessToken, 'userDirectory'>>> => {\n  if (!accessToken) {\n    return null;\n  }\n\n  try {\n    const decodedToken = decode(accessToken, { complete: true });\n    if (!decodedToken) {\n      return null;\n    }\n\n    const client = getCognitoJwksClient(`https://cognito-idp.${region}.amazonaws.com/${userPoolId}/.well-known/jwks.json`);\n\n    const key = await client.getSigningKey(decodedToken.header.kid);\n    const signingKey = key.getPublicKey();\n\n    const payload = verify(accessToken, signingKey, {\n      algorithms: ['RS256'],\n      issuer: `https://cognito-idp.${region}.amazonaws.com/${userPoolId}`,\n      ignoreExpiration,\n    }) as CognitoAccessTokenPayload;\n\n    // An id token from the same pool passes signature verification too; only\n    // access tokens are acceptable here.\n    if (payload.token_use !== 'access') {\n      return null;\n    }\n\n    return {\n      userId: payload.sub,\n      username: payload.username,\n      exp: payload.exp,\n      wasValid: true,\n    };\n  } catch (e) {\n    const summary = e instanceof Error ? `${e.name}: ${e.message}` : 'unknown error';\n    console.log('Failed to decode jwt token:', summary);\n    return null;\n  }\n};\n"]}

package/lib/commonjs/logic/cognito/forgotPassword.js

@@ -13,6 +13,7 @@ exports.forgotPassword = void 0;
 const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
 const createAwsClient_1 = require("../createAwsClient");
 const calculateSecretHash_1 = require("./utils/calculateSecretHash");
+const cognitoCodeDeliveryDetailsToQpqDeliveryDetails_1 = require("./utils/cognitoCodeDeliveryDetailsToQpqDeliveryDetails");
 const getUserPoolClientSecret_1 = require("./getUserPoolClientSecret");
 const forgotPassword = (userPoolId, clientId, region, username) => __awaiter(void 0, void 0, void 0, function* () {
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
@@ -29,12 +30,7 @@ const forgotPassword = (userPoolId, clientId, region, username) => __awaiter(voi
         },
     };
     const response = yield cognitoClient.send(new client_cognito_identity_provider_1.ForgotPasswordCommand(params));
-    const deliveryInfo = {
-        attributeName: response.CodeDeliveryDetails.AttributeName || 'email',
-        destination: response.CodeDeliveryDetails.Destination || 'unknown@email.com',
-        deliveryMedium: response.CodeDeliveryDetails.DeliveryMedium || 'EMAIL',
-    };
-    return deliveryInfo;
+    return (0, cognitoCodeDeliveryDetailsToQpqDeliveryDetails_1.cognitoCodeDeliveryDetailsToQpqDeliveryDetails)(response.CodeDeliveryDetails);
 });
 exports.forgotPassword = forgotPassword;
 //# sourceMappingURL=forgotPassword.js.map

package/lib/commonjs/logic/cognito/forgotPassword.js.map

@@ -1 +1 @@
-{"version":3,"file":"forgotPassword.js","sourceRoot":"","sources":["../../../../src/logic/cognito/forgotPassword.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAA6I;AAE7I,wDAAqD;AACrD,qEAAkE;AAClE,uEAAoE;AAE7D,MAAM,cAAc,GAAG,CAC5B,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,QAAgB,EACwB,EAAE;IAC1C,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,IAAA,iDAAuB,EAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,IAAA,yCAAmB,EAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAA+B;QACzC,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,UAAU;QACtB,cAAc,EAAE;YACd,aAAa,EAAE,MAAM;SACtB;KACF,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,wDAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IAE7E,MAAM,YAAY,GAAG;QACnB,aAAa,EAAE,QAAQ,CAAC,mBAAoB,CAAC,aAAa,IAAI,OAAO;QACrE,WAAW,EAAE,QAAQ,CAAC,mBAAoB,CAAC,WAAW,IAAI,mBAAmB;QAC7E,cAAc,EAAE,QAAQ,CAAC,mBAAoB,CAAC,cAAc,IAAI,OAAO;KACvC,CAAC;IAEnC,OAAO,YAAY,CAAC;AACtB,CAAC,CAAA,CAAC;AA/BW,QAAA,cAAc,kBA+BzB","sourcesContent":["import { AuthenticationDeliveryDetails } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ForgotPasswordCommand, ForgotPasswordCommandInput } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\nexport const forgotPassword = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  username: string,\n): Promise<AuthenticationDeliveryDetails> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  const params: ForgotPasswordCommandInput = {\n    ClientId: clientId,\n    Username: username,\n    SecretHash: secretHash,\n    ClientMetadata: {\n      userInitiated: 'true',\n    },\n  };\n\n  const response = await cognitoClient.send(new ForgotPasswordCommand(params));\n\n  const deliveryInfo = {\n    attributeName: response.CodeDeliveryDetails!.AttributeName || 'email',\n    destination: response.CodeDeliveryDetails!.Destination || 'unknown@email.com',\n    deliveryMedium: response.CodeDeliveryDetails!.DeliveryMedium || 'EMAIL',\n  } as AuthenticationDeliveryDetails;\n\n  return deliveryInfo;\n};\n"]}
+{"version":3,"file":"forgotPassword.js","sourceRoot":"","sources":["../../../../src/logic/cognito/forgotPassword.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAA6I;AAE7I,wDAAqD;AACrD,qEAAkE;AAClE,2HAAwH;AACxH,uEAAoE;AAE7D,MAAM,cAAc,GAAG,CAC5B,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,QAAgB,EACwB,EAAE;IAC1C,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,IAAA,iDAAuB,EAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,IAAA,yCAAmB,EAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAA+B;QACzC,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,UAAU;QACtB,cAAc,EAAE;YACd,aAAa,EAAE,MAAM;SACtB;KACF,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,wDAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IAE7E,OAAO,IAAA,+FAA8C,EAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;AACtF,CAAC,CAAA,CAAC;AAzBW,QAAA,cAAc,kBAyBzB","sourcesContent":["import { AuthenticationDeliveryDetails } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ForgotPasswordCommand, ForgotPasswordCommandInput } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { cognitoCodeDeliveryDetailsToQpqDeliveryDetails } from './utils/cognitoCodeDeliveryDetailsToQpqDeliveryDetails';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\nexport const forgotPassword = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  username: string,\n): Promise<AuthenticationDeliveryDetails> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  const params: ForgotPasswordCommandInput = {\n    ClientId: clientId,\n    Username: username,\n    SecretHash: secretHash,\n    ClientMetadata: {\n      userInitiated: 'true',\n    },\n  };\n\n  const response = await cognitoClient.send(new ForgotPasswordCommand(params));\n\n  return cognitoCodeDeliveryDetailsToQpqDeliveryDetails(response.CodeDeliveryDetails);\n};\n"]}

package/lib/commonjs/logic/cognito/getCognitoJwksClient.d.ts

@@ -0,0 +1,7 @@
+import { JwksClient } from 'jwks-rsa';
+/**
+ * Returns the JWKS client for a Cognito jwks.json uri. Memoized because jwks-rsa
+ * caches fetched signing keys per client instance; a fresh client per verification
+ * would refetch the pool's JWKS over HTTP on every call.
+ */
+export declare const getCognitoJwksClient: (jwksUri: string) => JwksClient;

package/lib/commonjs/logic/cognito/getCognitoJwksClient.js

@@ -0,0 +1,15 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCognitoJwksClient = void 0;
+const jwks_rsa_1 = __importDefault(require("jwks-rsa"));
+const memoFunc_1 = require("../cache/memoFunc");
+/**
+ * Returns the JWKS client for a Cognito jwks.json uri. Memoized because jwks-rsa
+ * caches fetched signing keys per client instance; a fresh client per verification
+ * would refetch the pool's JWKS over HTTP on every call.
+ */
+exports.getCognitoJwksClient = (0, memoFunc_1.memoFunc)((jwksUri) => (0, jwks_rsa_1.default)({ jwksUri }));
+//# sourceMappingURL=getCognitoJwksClient.js.map

package/lib/commonjs/logic/cognito/getCognitoJwksClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getCognitoJwksClient.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getCognitoJwksClient.ts"],"names":[],"mappings":";;;;;;AAAA,wDAAkD;AAElD,gDAA6C;AAE7C;;;;GAIG;AACU,QAAA,oBAAoB,GAAG,IAAA,mBAAQ,EAAC,CAAC,OAAe,EAAc,EAAE,CAAC,IAAA,kBAAU,EAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC","sourcesContent":["import jwksClient, { JwksClient } from 'jwks-rsa';\n\nimport { memoFunc } from '../cache/memoFunc';\n\n/**\n * Returns the JWKS client for a Cognito jwks.json uri. Memoized because jwks-rsa\n * caches fetched signing keys per client instance; a fresh client per verification\n * would refetch the pool's JWKS over HTTP on every call.\n */\nexport const getCognitoJwksClient = memoFunc((jwksUri: string): JwksClient => jwksClient({ jwksUri }));\n"]}

package/lib/commonjs/logic/cognito/getCognitoUserAttributesFromQpqUserAttributes.d.ts

@@ -0,0 +1,8 @@
+import { UserAttributes } from 'quidproquo-core';
+import { CognitoUserAttribute } from './utils/CognitoUserAttribute';
+/**
+ * Maps qpq UserAttributes onto Cognito Name/Value pairs. Keys with no Cognito
+ * mapping (e.g. password on CreateUserRequest) and absent or empty values are
+ * dropped; everything else is stringified (booleans become 'true'/'false').
+ */
+export declare const getCognitoUserAttributesFromQpqUserAttributes: (userAttributes: UserAttributes) => CognitoUserAttribute[];

package/lib/commonjs/logic/cognito/getCognitoUserAttributesFromQpqUserAttributes.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCognitoUserAttributesFromQpqUserAttributes = void 0;
+const cognitoAttributeMap_1 = require("./cognitoAttributeMap");
+/**
+ * Maps qpq UserAttributes onto Cognito Name/Value pairs. Keys with no Cognito
+ * mapping (e.g. password on CreateUserRequest) and absent or empty values are
+ * dropped; everything else is stringified (booleans become 'true'/'false').
+ */
+const getCognitoUserAttributesFromQpqUserAttributes = (userAttributes) => {
+    return Object.keys(userAttributes)
+        .filter((key) => userAttributes[key] !== undefined && userAttributes[key] !== null)
+        .map((key) => ({
+        Name: cognitoAttributeMap_1.cognitoAttributeMap[key],
+        Value: `${userAttributes[key]}`,
+    }))
+        .filter((attribute) => !!attribute.Name && !!attribute.Value);
+};
+exports.getCognitoUserAttributesFromQpqUserAttributes = getCognitoUserAttributesFromQpqUserAttributes;
+//# sourceMappingURL=getCognitoUserAttributesFromQpqUserAttributes.js.map

package/lib/commonjs/logic/cognito/getCognitoUserAttributesFromQpqUserAttributes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getCognitoUserAttributesFromQpqUserAttributes.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getCognitoUserAttributesFromQpqUserAttributes.ts"],"names":[],"mappings":";;;AAGA,+DAA4D;AAE5D;;;;GAIG;AACI,MAAM,6CAA6C,GAAG,CAAC,cAA8B,EAA0B,EAAE;IACtH,OAAQ,MAAM,CAAC,IAAI,CAAC,cAAc,CAA8B;SAC7D,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;SAClF,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACb,IAAI,EAAE,yCAAmB,CAAC,GAAG,CAAC;QAC9B,KAAK,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,EAAE;KAChC,CAAC,CAAC;SACF,MAAM,CAAC,CAAC,SAAS,EAAqC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACrG,CAAC,CAAC;AARW,QAAA,6CAA6C,iDAQxD","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { CognitoUserAttribute } from './utils/CognitoUserAttribute';\nimport { cognitoAttributeMap } from './cognitoAttributeMap';\n\n/**\n * Maps qpq UserAttributes onto Cognito Name/Value pairs. Keys with no Cognito\n * mapping (e.g. password on CreateUserRequest) and absent or empty values are\n * dropped; everything else is stringified (booleans become 'true'/'false').\n */\nexport const getCognitoUserAttributesFromQpqUserAttributes = (userAttributes: UserAttributes): CognitoUserAttribute[] => {\n  return (Object.keys(userAttributes) as (keyof UserAttributes)[])\n    .filter((key) => userAttributes[key] !== undefined && userAttributes[key] !== null)\n    .map((key) => ({\n      Name: cognitoAttributeMap[key],\n      Value: `${userAttributes[key]}`,\n    }))\n    .filter((attribute): attribute is CognitoUserAttribute => !!attribute.Name && !!attribute.Value);\n};\n"]}

package/lib/commonjs/logic/cognito/getQpqAttributeObjectFromCognitoKeyValue.d.ts

@@ -0,0 +1,7 @@
+import { UserAttributes } from 'quidproquo-core';
+/**
+ * Maps a single Cognito attribute name/value onto a partial UserAttributes object.
+ * Names with no qpq mapping (e.g. cognito:groups) produce an empty object, and
+ * email_verified is coerced from Cognito's 'true'/'false' string to a boolean.
+ */
+export declare const getQpqAttributeObjectFromCognitoKeyValue: (key: string, value: string) => UserAttributes;

package/lib/commonjs/logic/cognito/getQpqAttributeObjectFromCognitoKeyValue.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getQpqAttributeObjectFromCognitoKeyValue = void 0;
+const cognitoAttributeMap_1 = require("./cognitoAttributeMap");
+const reversedCognitoAttributeMap = Object.fromEntries(Object.entries(cognitoAttributeMap_1.cognitoAttributeMap).map(([qpqKey, cognitoName]) => [cognitoName, qpqKey]));
+/**
+ * Maps a single Cognito attribute name/value onto a partial UserAttributes object.
+ * Names with no qpq mapping (e.g. cognito:groups) produce an empty object, and
+ * email_verified is coerced from Cognito's 'true'/'false' string to a boolean.
+ */
+const getQpqAttributeObjectFromCognitoKeyValue = (key, value) => {
+    const userAttributeKey = reversedCognitoAttributeMap[key];
+    if (!userAttributeKey) {
+        return {};
+    }
+    if (userAttributeKey === 'emailVerified') {
+        return { emailVerified: value === 'true' };
+    }
+    return { [userAttributeKey]: value };
+};
+exports.getQpqAttributeObjectFromCognitoKeyValue = getQpqAttributeObjectFromCognitoKeyValue;
+//# sourceMappingURL=getQpqAttributeObjectFromCognitoKeyValue.js.map

package/lib/commonjs/logic/cognito/getQpqAttributeObjectFromCognitoKeyValue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getQpqAttributeObjectFromCognitoKeyValue.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getQpqAttributeObjectFromCognitoKeyValue.ts"],"names":[],"mappings":";;;AAEA,+DAA4D;AAE5D,MAAM,2BAA2B,GAAyC,MAAM,CAAC,WAAW,CAC1F,MAAM,CAAC,OAAO,CAAC,yCAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,MAA8B,CAAC,CAAC,CAClH,CAAC;AAEF;;;;GAIG;AACI,MAAM,wCAAwC,GAAG,CAAC,GAAW,EAAE,KAAa,EAAkB,EAAE;IACrG,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAE1D,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,gBAAgB,KAAK,eAAe,EAAE,CAAC;QACzC,OAAO,EAAE,aAAa,EAAE,KAAK,KAAK,MAAM,EAAE,CAAC;IAC7C,CAAC;IAED,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC;AACvC,CAAC,CAAC;AAZW,QAAA,wCAAwC,4CAYnD","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { cognitoAttributeMap } from './cognitoAttributeMap';\n\nconst reversedCognitoAttributeMap: Record<string, keyof UserAttributes> = Object.fromEntries(\n  Object.entries(cognitoAttributeMap).map(([qpqKey, cognitoName]) => [cognitoName, qpqKey as keyof UserAttributes]),\n);\n\n/**\n * Maps a single Cognito attribute name/value onto a partial UserAttributes object.\n * Names with no qpq mapping (e.g. cognito:groups) produce an empty object, and\n * email_verified is coerced from Cognito's 'true'/'false' string to a boolean.\n */\nexport const getQpqAttributeObjectFromCognitoKeyValue = (key: string, value: string): UserAttributes => {\n  const userAttributeKey = reversedCognitoAttributeMap[key];\n\n  if (!userAttributeKey) {\n    return {};\n  }\n\n  if (userAttributeKey === 'emailVerified') {\n    return { emailVerified: value === 'true' };\n  }\n\n  return { [userAttributeKey]: value };\n};\n"]}

package/lib/commonjs/logic/cognito/getQpqAttributesFromCognitoStringMap.d.ts

@@ -0,0 +1,6 @@
+import { UserAttributes } from 'quidproquo-core';
+/**
+ * Maps a Cognito name-to-value record (as delivered in lambda trigger events)
+ * onto the qpq UserAttributes shape.
+ */
+export declare const getQpqAttributesFromCognitoStringMap: (cognitoUserAttributes: Record<string, string>) => UserAttributes;

package/lib/commonjs/logic/cognito/getQpqAttributesFromCognitoStringMap.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getQpqAttributesFromCognitoStringMap = void 0;
+const getQpqAttributeObjectFromCognitoKeyValue_1 = require("./getQpqAttributeObjectFromCognitoKeyValue");
+/**
+ * Maps a Cognito name-to-value record (as delivered in lambda trigger events)
+ * onto the qpq UserAttributes shape.
+ */
+const getQpqAttributesFromCognitoStringMap = (cognitoUserAttributes) => {
+    const userAttributes = {};
+    for (const [key, value] of Object.entries(cognitoUserAttributes)) {
+        Object.assign(userAttributes, (0, getQpqAttributeObjectFromCognitoKeyValue_1.getQpqAttributeObjectFromCognitoKeyValue)(key, value));
+    }
+    return userAttributes;
+};
+exports.getQpqAttributesFromCognitoStringMap = getQpqAttributesFromCognitoStringMap;
+//# sourceMappingURL=getQpqAttributesFromCognitoStringMap.js.map

package/lib/commonjs/logic/cognito/getQpqAttributesFromCognitoStringMap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getQpqAttributesFromCognitoStringMap.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getQpqAttributesFromCognitoStringMap.ts"],"names":[],"mappings":";;;AAEA,yGAAsG;AAEtG;;;GAGG;AACI,MAAM,oCAAoC,GAAG,CAAC,qBAA6C,EAAkB,EAAE;IACpH,MAAM,cAAc,GAAmB,EAAE,CAAC;IAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACjE,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,IAAA,mFAAwC,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,OAAO,cAAc,CAAC;AACxB,CAAC,CAAC;AARW,QAAA,oCAAoC,wCAQ/C","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { getQpqAttributeObjectFromCognitoKeyValue } from './getQpqAttributeObjectFromCognitoKeyValue';\n\n/**\n * Maps a Cognito name-to-value record (as delivered in lambda trigger events)\n * onto the qpq UserAttributes shape.\n */\nexport const getQpqAttributesFromCognitoStringMap = (cognitoUserAttributes: Record<string, string>): UserAttributes => {\n  const userAttributes: UserAttributes = {};\n\n  for (const [key, value] of Object.entries(cognitoUserAttributes)) {\n    Object.assign(userAttributes, getQpqAttributeObjectFromCognitoKeyValue(key, value));\n  }\n\n  return userAttributes;\n};\n"]}

package/lib/commonjs/logic/cognito/getQpqAttributesFromCognitoUserAttributes.d.ts

@@ -0,0 +1,4 @@
+import { UserAttributes } from 'quidproquo-core';
+import { CognitoUserAttribute } from './utils/CognitoUserAttribute';
+/** Maps a list of Cognito user attributes onto the qpq UserAttributes shape. */
+export declare const getQpqAttributesFromCognitoUserAttributes: (cognitoUserAttributes: CognitoUserAttribute[]) => UserAttributes;

package/lib/commonjs/logic/cognito/getQpqAttributesFromCognitoUserAttributes.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getQpqAttributesFromCognitoUserAttributes = void 0;
+const getQpqAttributeObjectFromCognitoKeyValue_1 = require("./getQpqAttributeObjectFromCognitoKeyValue");
+/** Maps a list of Cognito user attributes onto the qpq UserAttributes shape. */
+const getQpqAttributesFromCognitoUserAttributes = (cognitoUserAttributes) => {
+    const userAttributes = {};
+    for (const { Name, Value } of cognitoUserAttributes) {
+        Object.assign(userAttributes, (0, getQpqAttributeObjectFromCognitoKeyValue_1.getQpqAttributeObjectFromCognitoKeyValue)(Name, Value));
+    }
+    return userAttributes;
+};
+exports.getQpqAttributesFromCognitoUserAttributes = getQpqAttributesFromCognitoUserAttributes;
+//# sourceMappingURL=getQpqAttributesFromCognitoUserAttributes.js.map

package/lib/commonjs/logic/cognito/getQpqAttributesFromCognitoUserAttributes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getQpqAttributesFromCognitoUserAttributes.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getQpqAttributesFromCognitoUserAttributes.ts"],"names":[],"mappings":";;;AAGA,yGAAsG;AAEtG,gFAAgF;AACzE,MAAM,yCAAyC,GAAG,CAAC,qBAA6C,EAAkB,EAAE;IACzH,MAAM,cAAc,GAAmB,EAAE,CAAC;IAE1C,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,qBAAqB,EAAE,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,IAAA,mFAAwC,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACvF,CAAC;IAED,OAAO,cAAc,CAAC;AACxB,CAAC,CAAC;AARW,QAAA,yCAAyC,6CAQpD","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { CognitoUserAttribute } from './utils/CognitoUserAttribute';\nimport { getQpqAttributeObjectFromCognitoKeyValue } from './getQpqAttributeObjectFromCognitoKeyValue';\n\n/** Maps a list of Cognito user attributes onto the qpq UserAttributes shape. */\nexport const getQpqAttributesFromCognitoUserAttributes = (cognitoUserAttributes: CognitoUserAttribute[]): UserAttributes => {\n  const userAttributes: UserAttributes = {};\n\n  for (const { Name, Value } of cognitoUserAttributes) {\n    Object.assign(userAttributes, getQpqAttributeObjectFromCognitoKeyValue(Name, Value));\n  }\n\n  return userAttributes;\n};\n"]}

package/lib/commonjs/logic/cognito/getUserAttributes.js

@@ -12,19 +12,17 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getUserAttributes = void 0;
 const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
 const createAwsClient_1 = require("../createAwsClient");
-const cognitoAttributeMap_1 = require("./cognitoAttributeMap");
+const getValidCognitoUserAttributes_1 = require("./utils/getValidCognitoUserAttributes");
+const getQpqAttributesFromCognitoUserAttributes_1 = require("./getQpqAttributesFromCognitoUserAttributes");
 const getUserAttributes = (userPoolId, region, username) => __awaiter(void 0, void 0, void 0, function* () {
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
         region,
     });
-    const params = {
+    const response = yield cognitoClient.send(new client_cognito_identity_provider_1.AdminGetUserCommand({
         UserPoolId: userPoolId,
         Username: username,
-    };
-    const response = yield cognitoClient.send(new client_cognito_identity_provider_1.AdminGetUserCommand(params));
-    const validAttributes = (response.UserAttributes || []).filter((attr) => attr.Name && attr.Value);
-    const attributes = (0, cognitoAttributeMap_1.getQpqAttributesFromCognitoUserAttributes)(validAttributes);
-    return attributes;
+    }));
+    return (0, getQpqAttributesFromCognitoUserAttributes_1.getQpqAttributesFromCognitoUserAttributes)((0, getValidCognitoUserAttributes_1.getValidCognitoUserAttributes)(response.UserAttributes));
 });
 exports.getUserAttributes = getUserAttributes;
 //# sourceMappingURL=getUserAttributes.js.map

package/lib/commonjs/logic/cognito/getUserAttributes.js.map

@@ -1 +1 @@
-{"version":3,"file":"getUserAttributes.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getUserAttributes.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAA+G;AAE/G,wDAAqD;AACrD,+DAAkF;AAE3E,MAAM,iBAAiB,GAAG,CAAO,UAAkB,EAAE,MAAc,EAAE,QAAgB,EAA2B,EAAE;IACvH,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;KACnB,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,sDAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IAE3E,MAAM,eAAe,GAAG,CAAC,QAAQ,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAsC,CAAC;IAEvI,MAAM,UAAU,GAAG,IAAA,+DAAyC,EAAC,eAAe,CAAC,CAAC;IAE9E,OAAO,UAAU,CAAC;AACpB,CAAC,CAAA,CAAC;AAjBW,QAAA,iBAAiB,qBAiB5B","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { AdminGetUserCommand, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getQpqAttributesFromCognitoUserAttributes } from './cognitoAttributeMap';\n\nexport const getUserAttributes = async (userPoolId: string, region: string, username: string): Promise<UserAttributes> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params = {\n    UserPoolId: userPoolId,\n    Username: username,\n  };\n\n  const response = await cognitoClient.send(new AdminGetUserCommand(params));\n\n  const validAttributes = (response.UserAttributes || []).filter((attr) => attr.Name && attr.Value) as { Name: string; Value: string }[];\n\n  const attributes = getQpqAttributesFromCognitoUserAttributes(validAttributes);\n\n  return attributes;\n};\n"]}
+{"version":3,"file":"getUserAttributes.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getUserAttributes.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAA+G;AAE/G,wDAAqD;AACrD,yFAAsF;AACtF,2GAAwG;AAEjG,MAAM,iBAAiB,GAAG,CAAO,UAAkB,EAAE,MAAc,EAAE,QAAgB,EAA2B,EAAE;IACvH,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CACvC,IAAI,sDAAmB,CAAC;QACtB,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;KACnB,CAAC,CACH,CAAC;IAEF,OAAO,IAAA,qFAAyC,EAAC,IAAA,6DAA6B,EAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;AAC3G,CAAC,CAAA,CAAC;AAbW,QAAA,iBAAiB,qBAa5B","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { AdminGetUserCommand, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getValidCognitoUserAttributes } from './utils/getValidCognitoUserAttributes';\nimport { getQpqAttributesFromCognitoUserAttributes } from './getQpqAttributesFromCognitoUserAttributes';\n\nexport const getUserAttributes = async (userPoolId: string, region: string, username: string): Promise<UserAttributes> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response = await cognitoClient.send(\n    new AdminGetUserCommand({\n      UserPoolId: userPoolId,\n      Username: username,\n    }),\n  );\n\n  return getQpqAttributesFromCognitoUserAttributes(getValidCognitoUserAttributes(response.UserAttributes));\n};\n"]}

package/lib/commonjs/logic/cognito/getUserAttributesBySub.js

@@ -12,7 +12,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getUserAttributesBySub = exports.UserNotFoundError = void 0;
 const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
 const createAwsClient_1 = require("../createAwsClient");
-const cognitoAttributeMap_1 = require("./cognitoAttributeMap");
+const buildCognitoUserFilter_1 = require("./utils/buildCognitoUserFilter");
+const getValidCognitoUserAttributes_1 = require("./utils/getValidCognitoUserAttributes");
+const getQpqAttributesFromCognitoUserAttributes_1 = require("./getQpqAttributesFromCognitoUserAttributes");
 // ListUsers returns an empty list rather than throwing for no match, so we throw
 // our own error with a discriminable `code` for the processor's catch to map.
 class UserNotFoundError extends Error {
@@ -23,20 +25,33 @@ class UserNotFoundError extends Error {
     }
 }
 exports.UserNotFoundError = UserNotFoundError;
+// A sub that cannot be embedded in a Cognito filter cannot belong to any user,
+// so unsafe input resolves to not-found instead of reaching Cognito.
+const buildSubFilter = (sub) => {
+    try {
+        return (0, buildCognitoUserFilter_1.buildCognitoUserFilter)('sub', sub);
+    }
+    catch (error) {
+        if (error instanceof buildCognitoUserFilter_1.InvalidCognitoFilterError) {
+            throw new UserNotFoundError();
+        }
+        throw error;
+    }
+};
 const getUserAttributesBySub = (userPoolId, region, sub) => __awaiter(void 0, void 0, void 0, function* () {
+    const filter = buildSubFilter(sub);
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
         region,
     });
     const response = yield cognitoClient.send(new client_cognito_identity_provider_1.ListUsersCommand({
         UserPoolId: userPoolId,
-        Filter: `sub = "${sub}"`,
+        Filter: filter,
     }));
     const [user] = (response === null || response === void 0 ? void 0 : response.Users) || [];
     if (!user) {
         throw new UserNotFoundError();
     }
-    const validAttributes = (user.Attributes || []).filter((attr) => attr.Name && attr.Value);
-    return (0, cognitoAttributeMap_1.getQpqAttributesFromCognitoUserAttributes)(validAttributes);
+    return (0, getQpqAttributesFromCognitoUserAttributes_1.getQpqAttributesFromCognitoUserAttributes)((0, getValidCognitoUserAttributes_1.getValidCognitoUserAttributes)(user.Attributes));
 });
 exports.getUserAttributesBySub = getUserAttributesBySub;
 //# sourceMappingURL=getUserAttributesBySub.js.map

package/lib/commonjs/logic/cognito/getUserAttributesBySub.js.map

@@ -1 +1 @@
-{"version":3,"file":"getUserAttributesBySub.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getUserAttributesBySub.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAA4G;AAE5G,wDAAqD;AACrD,+DAAkF;AAElF,iFAAiF;AACjF,8EAA8E;AAC9E,MAAa,iBAAkB,SAAQ,KAAK;IAG1C;QACE,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAHjB,SAAI,GAAG,gBAAgB,CAAC;QAI/B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAPD,8CAOC;AAEM,MAAM,sBAAsB,GAAG,CAAO,UAAkB,EAAE,MAAc,EAAE,GAAW,EAA2B,EAAE;IACvH,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CACvC,IAAI,mDAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,MAAM,EAAE,UAAU,GAAG,GAAG;KACzB,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,KAAK,KAAI,EAAE,CAAC;IACrC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAGrF,CAAC;IAEJ,OAAO,IAAA,+DAAyC,EAAC,eAAe,CAAC,CAAC;AACpE,CAAC,CAAA,CAAC;AAvBW,QAAA,sBAAsB,0BAuBjC","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getQpqAttributesFromCognitoUserAttributes } from './cognitoAttributeMap';\n\n// ListUsers returns an empty list rather than throwing for no match, so we throw\n// our own error with a discriminable `code` for the processor's catch to map.\nexport class UserNotFoundError extends Error {\n  readonly code = 'USER_NOT_FOUND';\n\n  constructor() {\n    super('User not found');\n    this.name = 'UserNotFoundError';\n  }\n}\n\nexport const getUserAttributesBySub = async (userPoolId: string, region: string, sub: string): Promise<UserAttributes> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      Filter: `sub = \"${sub}\"`,\n    }),\n  );\n\n  const [user] = response?.Users || [];\n  if (!user) {\n    throw new UserNotFoundError();\n  }\n\n  const validAttributes = (user.Attributes || []).filter((attr) => attr.Name && attr.Value) as {\n    Name: string;\n    Value: string;\n  }[];\n\n  return getQpqAttributesFromCognitoUserAttributes(validAttributes);\n};\n"]}
+{"version":3,"file":"getUserAttributesBySub.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getUserAttributesBySub.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAA4G;AAE5G,wDAAqD;AACrD,2EAAmG;AACnG,yFAAsF;AACtF,2GAAwG;AAExG,iFAAiF;AACjF,8EAA8E;AAC9E,MAAa,iBAAkB,SAAQ,KAAK;IAG1C;QACE,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAHjB,SAAI,GAAG,gBAAgB,CAAC;QAI/B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAPD,8CAOC;AAED,+EAA+E;AAC/E,qEAAqE;AACrE,MAAM,cAAc,GAAG,CAAC,GAAW,EAAU,EAAE;IAC7C,IAAI,CAAC;QACH,OAAO,IAAA,+CAAsB,EAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,kDAAyB,EAAE,CAAC;YAC/C,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAChC,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEK,MAAM,sBAAsB,GAAG,CAAO,UAAkB,EAAE,MAAc,EAAE,GAAW,EAA2B,EAAE;IACvH,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAEnC,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CACvC,IAAI,mDAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,MAAM,EAAE,MAAM;KACf,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,KAAK,KAAI,EAAE,CAAC;IACrC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAChC,CAAC;IAED,OAAO,IAAA,qFAAyC,EAAC,IAAA,6DAA6B,EAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;AACnG,CAAC,CAAA,CAAC;AApBW,QAAA,sBAAsB,0BAoBjC","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { buildCognitoUserFilter, InvalidCognitoFilterError } from './utils/buildCognitoUserFilter';\nimport { getValidCognitoUserAttributes } from './utils/getValidCognitoUserAttributes';\nimport { getQpqAttributesFromCognitoUserAttributes } from './getQpqAttributesFromCognitoUserAttributes';\n\n// ListUsers returns an empty list rather than throwing for no match, so we throw\n// our own error with a discriminable `code` for the processor's catch to map.\nexport class UserNotFoundError extends Error {\n  readonly code = 'USER_NOT_FOUND';\n\n  constructor() {\n    super('User not found');\n    this.name = 'UserNotFoundError';\n  }\n}\n\n// A sub that cannot be embedded in a Cognito filter cannot belong to any user,\n// so unsafe input resolves to not-found instead of reaching Cognito.\nconst buildSubFilter = (sub: string): string => {\n  try {\n    return buildCognitoUserFilter('sub', sub);\n  } catch (error) {\n    if (error instanceof InvalidCognitoFilterError) {\n      throw new UserNotFoundError();\n    }\n    throw error;\n  }\n};\n\nexport const getUserAttributesBySub = async (userPoolId: string, region: string, sub: string): Promise<UserAttributes> => {\n  const filter = buildSubFilter(sub);\n\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      Filter: filter,\n    }),\n  );\n\n  const [user] = response?.Users || [];\n  if (!user) {\n    throw new UserNotFoundError();\n  }\n\n  return getQpqAttributesFromCognitoUserAttributes(getValidCognitoUserAttributes(user.Attributes));\n};\n"]}

package/lib/commonjs/logic/cognito/getUserPoolClientSecret.d.ts

@@ -1 +1,9 @@
+export declare class ClientSecretNotFoundError extends Error {
+    readonly code = "CLIENT_SECRET_NOT_FOUND";
+    constructor();
+}
+/**
+ * Fetches the app client's secret (needed to compute the SECRET_HASH for auth
+ * flows). Throws ClientSecretNotFoundError when the client has no secret.
+ */
 export declare const getUserPoolClientSecret: (userPoolId: string, clientId: string, region: string) => Promise<string>;