quidproquo-actionprocessor-awslambda 0.1.11 → 0.1.12

package/lib/commonjs/logic/cognito/getUserPoolClientSecret.js

@@ -9,11 +9,25 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getUserPoolClientSecret = void 0;
+exports.getUserPoolClientSecret = exports.ClientSecretNotFoundError = void 0;
 const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
 const createAwsClient_1 = require("../createAwsClient");
+// DescribeUserPoolClient succeeds even when the app client has no secret, so a
+// missing secret is a hand-thrown, discriminable configuration error.
+class ClientSecretNotFoundError extends Error {
+    constructor() {
+        super('Can not find client secret for Cognito user pool client');
+        this.code = 'CLIENT_SECRET_NOT_FOUND';
+        this.name = 'ClientSecretNotFoundError';
+    }
+}
+exports.ClientSecretNotFoundError = ClientSecretNotFoundError;
+/**
+ * Fetches the app client's secret (needed to compute the SECRET_HASH for auth
+ * flows). Throws ClientSecretNotFoundError when the client has no secret.
+ */
 const getUserPoolClientSecret = (userPoolId, clientId, region) => __awaiter(void 0, void 0, void 0, function* () {
-    var _a, _b;
+    var _a;
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
         region,
     });
@@ -22,10 +36,11 @@ const getUserPoolClientSecret = (userPoolId, clientId, region) => __awaiter(void
         UserPoolId: userPoolId,
     };
     const response = yield cognitoClient.send(new client_cognito_identity_provider_1.DescribeUserPoolClientCommand(params));
-    if (!((_a = response.UserPoolClient) === null || _a === void 0 ? void 0 : _a.ClientSecret)) {
-        throw new Error('Can not find client secret for Cognito user pool client');
+    const clientSecret = (_a = response.UserPoolClient) === null || _a === void 0 ? void 0 : _a.ClientSecret;
+    if (!clientSecret) {
+        throw new ClientSecretNotFoundError();
     }
-    return (_b = response.UserPoolClient) === null || _b === void 0 ? void 0 : _b.ClientSecret;
+    return clientSecret;
 });
 exports.getUserPoolClientSecret = getUserPoolClientSecret;
 //# sourceMappingURL=getUserPoolClientSecret.js.map

package/lib/commonjs/logic/cognito/getUserPoolClientSecret.js.map

@@ -1 +1 @@
-{"version":3,"file":"getUserPoolClientSecret.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getUserPoolClientSecret.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gGAImD;AAEnD,wDAAqD;AAE9C,MAAM,uBAAuB,GAAG,CAAO,UAAkB,EAAE,QAAgB,EAAE,MAAc,EAAmB,EAAE;;IACrH,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAAuC;QACjD,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,UAAU;KACvB,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,gEAA6B,CAAC,MAAM,CAAC,CAAC,CAAC;IAErF,IAAI,CAAC,CAAA,MAAA,QAAQ,CAAC,cAAc,0CAAE,YAAY,CAAA,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,MAAA,QAAQ,CAAC,cAAc,0CAAE,YAAY,CAAC;AAC/C,CAAC,CAAA,CAAC;AAjBW,QAAA,uBAAuB,2BAiBlC","sourcesContent":["import {\n  CognitoIdentityProviderClient,\n  DescribeUserPoolClientCommand,\n  DescribeUserPoolClientCommandInput,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\n\nexport const getUserPoolClientSecret = async (userPoolId: string, clientId: string, region: string): Promise<string> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params: DescribeUserPoolClientCommandInput = {\n    ClientId: clientId,\n    UserPoolId: userPoolId,\n  };\n\n  const response = await cognitoClient.send(new DescribeUserPoolClientCommand(params));\n\n  if (!response.UserPoolClient?.ClientSecret) {\n    throw new Error('Can not find client secret for Cognito user pool client');\n  }\n\n  return response.UserPoolClient?.ClientSecret;\n};\n"]}
+{"version":3,"file":"getUserPoolClientSecret.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getUserPoolClientSecret.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gGAImD;AAEnD,wDAAqD;AAErD,+EAA+E;AAC/E,sEAAsE;AACtE,MAAa,yBAA0B,SAAQ,KAAK;IAGlD;QACE,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAH1D,SAAI,GAAG,yBAAyB,CAAC;QAIxC,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAPD,8DAOC;AAED;;;GAGG;AACI,MAAM,uBAAuB,GAAG,CAAO,UAAkB,EAAE,QAAgB,EAAE,MAAc,EAAmB,EAAE;;IACrH,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAAuC;QACjD,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,UAAU;KACvB,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,gEAA6B,CAAC,MAAM,CAAC,CAAC,CAAC;IAErF,MAAM,YAAY,GAAG,MAAA,QAAQ,CAAC,cAAc,0CAAE,YAAY,CAAC;IAC3D,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,yBAAyB,EAAE,CAAC;IACxC,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC,CAAA,CAAC;AAlBW,QAAA,uBAAuB,2BAkBlC","sourcesContent":["import {\n  CognitoIdentityProviderClient,\n  DescribeUserPoolClientCommand,\n  DescribeUserPoolClientCommandInput,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\n\n// DescribeUserPoolClient succeeds even when the app client has no secret, so a\n// missing secret is a hand-thrown, discriminable configuration error.\nexport class ClientSecretNotFoundError extends Error {\n  readonly code = 'CLIENT_SECRET_NOT_FOUND';\n\n  constructor() {\n    super('Can not find client secret for Cognito user pool client');\n    this.name = 'ClientSecretNotFoundError';\n  }\n}\n\n/**\n * Fetches the app client's secret (needed to compute the SECRET_HASH for auth\n * flows). Throws ClientSecretNotFoundError when the client has no secret.\n */\nexport const getUserPoolClientSecret = async (userPoolId: string, clientId: string, region: string): Promise<string> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params: DescribeUserPoolClientCommandInput = {\n    ClientId: clientId,\n    UserPoolId: userPoolId,\n  };\n\n  const response = await cognitoClient.send(new DescribeUserPoolClientCommand(params));\n\n  const clientSecret = response.UserPoolClient?.ClientSecret;\n  if (!clientSecret) {\n    throw new ClientSecretNotFoundError();\n  }\n\n  return clientSecret;\n};\n"]}

package/lib/commonjs/logic/cognito/index.js

@@ -14,6 +14,9 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+// Deliberately curated: this barrel is re-exported from the package root (via
+// src/logic/index.ts), so everything here is public API. Internal consumers
+// import sibling files directly; only add here to grow the public surface.
 __exportStar(require("./decodeAccessToken"), exports);
 __exportStar(require("./decodeValidJwt"), exports);
 __exportStar(require("./globalSignOut"), exports);

package/lib/commonjs/logic/cognito/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/logic/cognito/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAoC;AACpC,mDAAiC;AACjC,kDAAgC;AAChC,uDAAqC","sourcesContent":["export * from './decodeAccessToken';\nexport * from './decodeValidJwt';\nexport * from './globalSignOut';\nexport * from './revokeRefreshToken';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/logic/cognito/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,sDAAoC;AACpC,mDAAiC;AACjC,kDAAgC;AAChC,uDAAqC","sourcesContent":["// Deliberately curated: this barrel is re-exported from the package root (via\n// src/logic/index.ts), so everything here is public API. Internal consumers\n// import sibling files directly; only add here to grow the public surface.\nexport * from './decodeAccessToken';\nexport * from './decodeValidJwt';\nexport * from './globalSignOut';\nexport * from './revokeRefreshToken';\n"]}

package/lib/commonjs/logic/cognito/listPagedUsers.js

@@ -12,7 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.listPagedUsers = void 0;
 const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
 const createAwsClient_1 = require("../createAwsClient");
-const cognitoAttributeMap_1 = require("./cognitoAttributeMap");
+const getQpqAttributesFromCognitoUserAttributes_1 = require("./getQpqAttributesFromCognitoUserAttributes");
 const utils_1 = require("./utils");
 const listPagedUsers = (userPoolId, region, pageKey) => __awaiter(void 0, void 0, void 0, function* () {
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
@@ -22,13 +22,9 @@ const listPagedUsers = (userPoolId, region, pageKey) => __awaiter(void 0, void 0
         UserPoolId: userPoolId,
         PaginationToken: (0, utils_1.pageKeyToPaginationToken)(pageKey),
     }));
-    const users = (response.Users || []).map((user) => {
-        const validAttributes = (user.Attributes || []).filter((attr) => attr.Name && attr.Value);
-        return (0, cognitoAttributeMap_1.getQpqAttributesFromCognitoUserAttributes)(validAttributes);
-    });
     return {
         nextPageKey: (0, utils_1.paginationTokenToPageKey)(response.PaginationToken),
-        items: users,
+        items: (response.Users || []).map((user) => (0, getQpqAttributesFromCognitoUserAttributes_1.getQpqAttributesFromCognitoUserAttributes)((0, utils_1.getValidCognitoUserAttributes)(user.Attributes))),
     };
 });
 exports.listPagedUsers = listPagedUsers;

package/lib/commonjs/logic/cognito/listPagedUsers.js.map

@@ -1 +1 @@
-{"version":3,"file":"listPagedUsers.js","sourceRoot":"","sources":["../../../../src/logic/cognito/listPagedUsers.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAA+H;AAE/H,wDAAqD;AACrD,+DAAkF;AAClF,mCAA6E;AAEtE,MAAM,cAAc,GAAG,CAAO,UAAkB,EAAE,MAAc,EAAE,OAAgB,EAAyC,EAAE;IAClI,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAsB,MAAM,aAAa,CAAC,IAAI,CAC1D,IAAI,mDAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,eAAe,EAAE,IAAA,gCAAwB,EAAC,OAAO,CAAC;KACnD,CAAC,CACH,CAAC;IAEF,MAAM,KAAK,GAAqB,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAClE,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAGrF,CAAC;QAEJ,OAAO,IAAA,+DAAyC,EAAC,eAAe,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,WAAW,EAAE,IAAA,gCAAwB,EAAC,QAAQ,CAAC,eAAe,CAAC;QAC/D,KAAK,EAAE,KAAK;KACb,CAAC;AACJ,CAAC,CAAA,CAAC;AAzBW,QAAA,cAAc,kBAyBzB","sourcesContent":["import { QpqPagedData, UserAttributes } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ListUsersCommand, ListUsersResponse } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getQpqAttributesFromCognitoUserAttributes } from './cognitoAttributeMap';\nimport { pageKeyToPaginationToken, paginationTokenToPageKey } from './utils';\n\nexport const listPagedUsers = async (userPoolId: string, region: string, pageKey?: string): Promise<QpqPagedData<UserAttributes>> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response: ListUsersResponse = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      PaginationToken: pageKeyToPaginationToken(pageKey),\n    }),\n  );\n\n  const users: UserAttributes[] = (response.Users || []).map((user) => {\n    const validAttributes = (user.Attributes || []).filter((attr) => attr.Name && attr.Value) as {\n      Name: string;\n      Value: string;\n    }[];\n\n    return getQpqAttributesFromCognitoUserAttributes(validAttributes);\n  });\n\n  return {\n    nextPageKey: paginationTokenToPageKey(response.PaginationToken),\n    items: users,\n  };\n};\n"]}
+{"version":3,"file":"listPagedUsers.js","sourceRoot":"","sources":["../../../../src/logic/cognito/listPagedUsers.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAA4G;AAE5G,wDAAqD;AACrD,2GAAwG;AACxG,mCAA4G;AAErG,MAAM,cAAc,GAAG,CAAO,UAAkB,EAAE,MAAc,EAAE,OAAgB,EAAyC,EAAE;IAClI,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CACvC,IAAI,mDAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,eAAe,EAAE,IAAA,gCAAwB,EAAC,OAAO,CAAC;KACnD,CAAC,CACH,CAAC;IAEF,OAAO;QACL,WAAW,EAAE,IAAA,gCAAwB,EAAC,QAAQ,CAAC,eAAe,CAAC;QAC/D,KAAK,EAAE,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,qFAAyC,EAAC,IAAA,qCAA6B,EAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;KACvI,CAAC;AACJ,CAAC,CAAA,CAAC;AAhBW,QAAA,cAAc,kBAgBzB","sourcesContent":["import { QpqPagedData, UserAttributes } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getQpqAttributesFromCognitoUserAttributes } from './getQpqAttributesFromCognitoUserAttributes';\nimport { getValidCognitoUserAttributes, pageKeyToPaginationToken, paginationTokenToPageKey } from './utils';\n\nexport const listPagedUsers = async (userPoolId: string, region: string, pageKey?: string): Promise<QpqPagedData<UserAttributes>> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      PaginationToken: pageKeyToPaginationToken(pageKey),\n    }),\n  );\n\n  return {\n    nextPageKey: paginationTokenToPageKey(response.PaginationToken),\n    items: (response.Users || []).map((user) => getQpqAttributesFromCognitoUserAttributes(getValidCognitoUserAttributes(user.Attributes))),\n  };\n};\n"]}

package/lib/commonjs/logic/cognito/listPagedUsersByAttribute.d.ts

@@ -1,2 +1,7 @@
 import { QpqPagedData, UserAttributes } from 'quidproquo-core';
+/**
+ * Lists users whose attribute exactly matches the given value.
+ * Throws InvalidCognitoFilterError (code INVALID_COGNITO_FILTER) when the
+ * attribute name or value cannot be embedded safely in a Cognito filter.
+ */
 export declare const listPagedUsersByAttribute: (userPoolId: string, region: string, attributeName: string, attributeValue: string, limit?: number, pageKey?: string) => Promise<QpqPagedData<UserAttributes>>;

package/lib/commonjs/logic/cognito/listPagedUsersByAttribute.js

@@ -12,8 +12,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.listPagedUsersByAttribute = void 0;
 const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
 const createAwsClient_1 = require("../createAwsClient");
-const cognitoAttributeMap_1 = require("./cognitoAttributeMap");
+const getQpqAttributesFromCognitoUserAttributes_1 = require("./getQpqAttributesFromCognitoUserAttributes");
 const utils_1 = require("./utils");
+/**
+ * Lists users whose attribute exactly matches the given value.
+ * Throws InvalidCognitoFilterError (code INVALID_COGNITO_FILTER) when the
+ * attribute name or value cannot be embedded safely in a Cognito filter.
+ */
 const listPagedUsersByAttribute = (userPoolId, region, attributeName, attributeValue, limit, pageKey) => __awaiter(void 0, void 0, void 0, function* () {
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
         region,
@@ -21,16 +26,12 @@ const listPagedUsersByAttribute = (userPoolId, region, attributeName, attributeV
     const response = yield cognitoClient.send(new client_cognito_identity_provider_1.ListUsersCommand({
         UserPoolId: userPoolId,
         Limit: limit,
-        Filter: `${attributeName} = "${attributeValue}"`,
+        Filter: (0, utils_1.buildCognitoUserFilter)(attributeName, attributeValue),
         PaginationToken: (0, utils_1.pageKeyToPaginationToken)(pageKey),
     }));
-    const users = (response.Users || []).map((user) => {
-        const validAttributes = (user.Attributes || []).filter((attr) => attr.Name && attr.Value);
-        return (0, cognitoAttributeMap_1.getQpqAttributesFromCognitoUserAttributes)(validAttributes);
-    });
     return {
         nextPageKey: (0, utils_1.paginationTokenToPageKey)(response.PaginationToken),
-        items: users,
+        items: (response.Users || []).map((user) => (0, getQpqAttributesFromCognitoUserAttributes_1.getQpqAttributesFromCognitoUserAttributes)((0, utils_1.getValidCognitoUserAttributes)(user.Attributes))),
     };
 });
 exports.listPagedUsersByAttribute = listPagedUsersByAttribute;

package/lib/commonjs/logic/cognito/listPagedUsersByAttribute.js.map

@@ -1 +1 @@
-{"version":3,"file":"listPagedUsersByAttribute.js","sourceRoot":"","sources":["../../../../src/logic/cognito/listPagedUsersByAttribute.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAA+H;AAE/H,wDAAqD;AACrD,+DAAkF;AAClF,mCAA6E;AAEtE,MAAM,yBAAyB,GAAG,CACvC,UAAkB,EAClB,MAAc,EACd,aAAqB,EACrB,cAAsB,EACtB,KAAc,EACd,OAAgB,EACuB,EAAE;IACzC,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAsB,MAAM,aAAa,CAAC,IAAI,CAC1D,IAAI,mDAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,GAAG,aAAa,OAAO,cAAc,GAAG;QAChD,eAAe,EAAE,IAAA,gCAAwB,EAAC,OAAO,CAAC;KACnD,CAAC,CACH,CAAC;IAEF,MAAM,KAAK,GAAqB,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAClE,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAGrF,CAAC;QAEJ,OAAO,IAAA,+DAAyC,EAAC,eAAe,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,WAAW,EAAE,IAAA,gCAAwB,EAAC,QAAQ,CAAC,eAAe,CAAC;QAC/D,KAAK,EAAE,KAAK;KACb,CAAC;AACJ,CAAC,CAAA,CAAC;AAlCW,QAAA,yBAAyB,6BAkCpC","sourcesContent":["import { QpqPagedData, UserAttributes } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ListUsersCommand, ListUsersResponse } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getQpqAttributesFromCognitoUserAttributes } from './cognitoAttributeMap';\nimport { pageKeyToPaginationToken, paginationTokenToPageKey } from './utils';\n\nexport const listPagedUsersByAttribute = async (\n  userPoolId: string,\n  region: string,\n  attributeName: string,\n  attributeValue: string,\n  limit?: number,\n  pageKey?: string,\n): Promise<QpqPagedData<UserAttributes>> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response: ListUsersResponse = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      Limit: limit,\n      Filter: `${attributeName} = \"${attributeValue}\"`,\n      PaginationToken: pageKeyToPaginationToken(pageKey),\n    }),\n  );\n\n  const users: UserAttributes[] = (response.Users || []).map((user) => {\n    const validAttributes = (user.Attributes || []).filter((attr) => attr.Name && attr.Value) as {\n      Name: string;\n      Value: string;\n    }[];\n\n    return getQpqAttributesFromCognitoUserAttributes(validAttributes);\n  });\n\n  return {\n    nextPageKey: paginationTokenToPageKey(response.PaginationToken),\n    items: users,\n  };\n};\n"]}
+{"version":3,"file":"listPagedUsersByAttribute.js","sourceRoot":"","sources":["../../../../src/logic/cognito/listPagedUsersByAttribute.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAA4G;AAE5G,wDAAqD;AACrD,2GAAwG;AACxG,mCAAoI;AAEpI;;;;GAIG;AACI,MAAM,yBAAyB,GAAG,CACvC,UAAkB,EAClB,MAAc,EACd,aAAqB,EACrB,cAAsB,EACtB,KAAc,EACd,OAAgB,EACuB,EAAE;IACzC,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CACvC,IAAI,mDAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,IAAA,8BAAsB,EAAC,aAAa,EAAE,cAAc,CAAC;QAC7D,eAAe,EAAE,IAAA,gCAAwB,EAAC,OAAO,CAAC;KACnD,CAAC,CACH,CAAC;IAEF,OAAO;QACL,WAAW,EAAE,IAAA,gCAAwB,EAAC,QAAQ,CAAC,eAAe,CAAC;QAC/D,KAAK,EAAE,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,qFAAyC,EAAC,IAAA,qCAA6B,EAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;KACvI,CAAC;AACJ,CAAC,CAAA,CAAC;AAzBW,QAAA,yBAAyB,6BAyBpC","sourcesContent":["import { QpqPagedData, UserAttributes } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getQpqAttributesFromCognitoUserAttributes } from './getQpqAttributesFromCognitoUserAttributes';\nimport { buildCognitoUserFilter, getValidCognitoUserAttributes, pageKeyToPaginationToken, paginationTokenToPageKey } from './utils';\n\n/**\n * Lists users whose attribute exactly matches the given value.\n * Throws InvalidCognitoFilterError (code INVALID_COGNITO_FILTER) when the\n * attribute name or value cannot be embedded safely in a Cognito filter.\n */\nexport const listPagedUsersByAttribute = async (\n  userPoolId: string,\n  region: string,\n  attributeName: string,\n  attributeValue: string,\n  limit?: number,\n  pageKey?: string,\n): Promise<QpqPagedData<UserAttributes>> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      Limit: limit,\n      Filter: buildCognitoUserFilter(attributeName, attributeValue),\n      PaginationToken: pageKeyToPaginationToken(pageKey),\n    }),\n  );\n\n  return {\n    nextPageKey: paginationTokenToPageKey(response.PaginationToken),\n    items: (response.Users || []).map((user) => getQpqAttributesFromCognitoUserAttributes(getValidCognitoUserAttributes(user.Attributes))),\n  };\n};\n"]}

package/lib/commonjs/logic/cognito/refreshToken.js

@@ -13,7 +13,7 @@ exports.refreshToken = void 0;
 const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
 const createAwsClient_1 = require("../createAwsClient");
 const calculateSecretHash_1 = require("./utils/calculateSecretHash");
-const transformCognitoResponse_1 = require("./utils/transformCognitoResponse");
+const cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo_1 = require("./utils/cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo");
 const getUserPoolClientSecret_1 = require("./getUserPoolClientSecret");
 const refreshToken = (userPoolId, clientId, region, username, refreshToken) => __awaiter(void 0, void 0, void 0, function* () {
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
@@ -30,15 +30,16 @@ const refreshToken = (userPoolId, clientId, region, username, refreshToken) => _
             SECRET_HASH: secretHash,
         },
     };
-    // Time we issued the request
+    // Token expiry is computed relative to this; captured before the call so the
+    // derived expiresAt errs early rather than late.
     const issueDateTime = new Date().toISOString();
     const response = yield cognitoClient.send(new client_cognito_identity_provider_1.AdminInitiateAuthCommand(params));
-    const authResponse = (0, transformCognitoResponse_1.cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo)(response, issueDateTime);
-    // Cognito's REFRESH_TOKEN_AUTH flow does NOT return a refresh token — the existing one stays
-    // valid and is reused — so AuthenticationResult.RefreshToken is undefined here. Carry the
-    // caller's refresh token forward so the client keeps a usable session; without this it's
-    // dropped after the first refresh and the session can never refresh again. (If refresh-token
-    // rotation is ever enabled, Cognito DOES return a new one — then we keep that instead.)
+    const authResponse = (0, cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo_1.cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo)(response, issueDateTime);
+    // With rotation disabled, Cognito's REFRESH_TOKEN_AUTH flow does not return a
+    // refresh token: the existing one stays valid and is reused. Carry the caller's
+    // token forward so the client keeps a usable session; without this it is dropped
+    // after the first refresh and the session can never refresh again. If rotation
+    // is ever enabled Cognito does return a new token, and that one wins.
     if (authResponse.authenticationInfo && !authResponse.authenticationInfo.refreshToken) {
         authResponse.authenticationInfo.refreshToken = refreshToken;
     }

package/lib/commonjs/logic/cognito/refreshToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"refreshToken.js","sourceRoot":"","sources":["../../../../src/logic/cognito/refreshToken.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAKmD;AAEnD,wDAAqD;AACrD,qEAAkE;AAClE,+EAA2G;AAC3G,uEAAoE;AAE7D,MAAM,YAAY,GAAG,CAC1B,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,QAAgB,EAChB,YAAoB,EACe,EAAE;IACrC,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,IAAA,iDAAuB,EAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,IAAA,yCAAmB,EAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAkC;QAC5C,QAAQ,EAAE,+CAAY,CAAC,kBAAkB;QACzC,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAElB,cAAc,EAAE;YACd,aAAa,EAAE,YAAY;YAC3B,WAAW,EAAE,UAAU;SACxB;KACF,CAAC;IAEF,6BAA6B;IAC7B,MAAM,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,2DAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhF,MAAM,YAAY,GAAG,IAAA,kFAAuD,EAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAEtG,6FAA6F;IAC7F,0FAA0F;IAC1F,yFAAyF;IACzF,6FAA6F;IAC7F,wFAAwF;IACxF,IAAI,YAAY,CAAC,kBAAkB,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,YAAY,EAAE,CAAC;QACrF,YAAY,CAAC,kBAAkB,CAAC,YAAY,GAAG,YAAY,CAAC;IAC9D,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC,CAAA,CAAC;AAzCW,QAAA,YAAY,gBAyCvB","sourcesContent":["import { AuthenticateUserResponse } from 'quidproquo-core';\n\nimport {\n  AdminInitiateAuthCommand,\n  AdminInitiateAuthCommandInput,\n  AuthFlowType,\n  CognitoIdentityProviderClient,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo } from './utils/transformCognitoResponse';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\nexport const refreshToken = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  username: string,\n  refreshToken: string,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  const params: AdminInitiateAuthCommandInput = {\n    AuthFlow: AuthFlowType.REFRESH_TOKEN_AUTH,\n    UserPoolId: userPoolId,\n    ClientId: clientId,\n\n    AuthParameters: {\n      REFRESH_TOKEN: refreshToken,\n      SECRET_HASH: secretHash,\n    },\n  };\n\n  // Time we issued the request\n  const issueDateTime = new Date().toISOString();\n  const response = await cognitoClient.send(new AdminInitiateAuthCommand(params));\n\n  const authResponse = cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo(response, issueDateTime);\n\n  // Cognito's REFRESH_TOKEN_AUTH flow does NOT return a refresh token — the existing one stays\n  // valid and is reused — so AuthenticationResult.RefreshToken is undefined here. Carry the\n  // caller's refresh token forward so the client keeps a usable session; without this it's\n  // dropped after the first refresh and the session can never refresh again. (If refresh-token\n  // rotation is ever enabled, Cognito DOES return a new one — then we keep that instead.)\n  if (authResponse.authenticationInfo && !authResponse.authenticationInfo.refreshToken) {\n    authResponse.authenticationInfo.refreshToken = refreshToken;\n  }\n\n  return authResponse;\n};\n"]}
+{"version":3,"file":"refreshToken.js","sourceRoot":"","sources":["../../../../src/logic/cognito/refreshToken.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAKmD;AAEnD,wDAAqD;AACrD,qEAAkE;AAClE,6IAA0I;AAC1I,uEAAoE;AAE7D,MAAM,YAAY,GAAG,CAC1B,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,QAAgB,EAChB,YAAoB,EACe,EAAE;IACrC,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,IAAA,iDAAuB,EAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,IAAA,yCAAmB,EAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAkC;QAC5C,QAAQ,EAAE,+CAAY,CAAC,kBAAkB;QACzC,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAElB,cAAc,EAAE;YACd,aAAa,EAAE,YAAY;YAC3B,WAAW,EAAE,UAAU;SACxB;KACF,CAAC;IAEF,6EAA6E;IAC7E,iDAAiD;IACjD,MAAM,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,2DAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhF,MAAM,YAAY,GAAG,IAAA,iHAAuD,EAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAEtG,8EAA8E;IAC9E,gFAAgF;IAChF,iFAAiF;IACjF,+EAA+E;IAC/E,sEAAsE;IACtE,IAAI,YAAY,CAAC,kBAAkB,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,YAAY,EAAE,CAAC;QACrF,YAAY,CAAC,kBAAkB,CAAC,YAAY,GAAG,YAAY,CAAC;IAC9D,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC,CAAA,CAAC;AA1CW,QAAA,YAAY,gBA0CvB","sourcesContent":["import { AuthenticateUserResponse } from 'quidproquo-core';\n\nimport {\n  AdminInitiateAuthCommand,\n  AdminInitiateAuthCommandInput,\n  AuthFlowType,\n  CognitoIdentityProviderClient,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo } from './utils/cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\nexport const refreshToken = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  username: string,\n  refreshToken: string,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  const params: AdminInitiateAuthCommandInput = {\n    AuthFlow: AuthFlowType.REFRESH_TOKEN_AUTH,\n    UserPoolId: userPoolId,\n    ClientId: clientId,\n\n    AuthParameters: {\n      REFRESH_TOKEN: refreshToken,\n      SECRET_HASH: secretHash,\n    },\n  };\n\n  // Token expiry is computed relative to this; captured before the call so the\n  // derived expiresAt errs early rather than late.\n  const issueDateTime = new Date().toISOString();\n  const response = await cognitoClient.send(new AdminInitiateAuthCommand(params));\n\n  const authResponse = cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo(response, issueDateTime);\n\n  // With rotation disabled, Cognito's REFRESH_TOKEN_AUTH flow does not return a\n  // refresh token: the existing one stays valid and is reused. Carry the caller's\n  // token forward so the client keeps a usable session; without this it is dropped\n  // after the first refresh and the session can never refresh again. If rotation\n  // is ever enabled Cognito does return a new token, and that one wins.\n  if (authResponse.authenticationInfo && !authResponse.authenticationInfo.refreshToken) {\n    authResponse.authenticationInfo.refreshToken = refreshToken;\n  }\n\n  return authResponse;\n};\n"]}

package/lib/commonjs/logic/cognito/requestEmailVerificationCode.js

@@ -12,22 +12,17 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.requestEmailVerificationCode = void 0;
 const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
 const createAwsClient_1 = require("../createAwsClient");
+const cognitoCodeDeliveryDetailsToQpqDeliveryDetails_1 = require("./utils/cognitoCodeDeliveryDetailsToQpqDeliveryDetails");
 const requestEmailVerificationCode = (region, accessToken) => __awaiter(void 0, void 0, void 0, function* () {
-    var _a, _b, _c;
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
         region,
     });
     const params = {
         AccessToken: accessToken,
-        AttributeName: 'email', // Request verification for the email attribute
+        AttributeName: 'email',
     };
     const response = yield cognitoClient.send(new client_cognito_identity_provider_1.GetUserAttributeVerificationCodeCommand(params));
-    const deliveryInfo = {
-        attributeName: ((_a = response.CodeDeliveryDetails) === null || _a === void 0 ? void 0 : _a.AttributeName) || 'email',
-        destination: ((_b = response.CodeDeliveryDetails) === null || _b === void 0 ? void 0 : _b.Destination) || 'unknown@email.com',
-        deliveryMedium: ((_c = response.CodeDeliveryDetails) === null || _c === void 0 ? void 0 : _c.DeliveryMedium) || 'EMAIL',
-    };
-    return deliveryInfo;
+    return (0, cognitoCodeDeliveryDetailsToQpqDeliveryDetails_1.cognitoCodeDeliveryDetailsToQpqDeliveryDetails)(response.CodeDeliveryDetails);
 });
 exports.requestEmailVerificationCode = requestEmailVerificationCode;
 //# sourceMappingURL=requestEmailVerificationCode.js.map

package/lib/commonjs/logic/cognito/requestEmailVerificationCode.js.map

@@ -1 +1 @@
-{"version":3,"file":"requestEmailVerificationCode.js","sourceRoot":"","sources":["../../../../src/logic/cognito/requestEmailVerificationCode.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAImD;AAEnD,wDAAqD;AAE9C,MAAM,4BAA4B,GAAG,CAAO,MAAc,EAAE,WAAmB,EAA0C,EAAE;;IAChI,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAAiD;QAC3D,WAAW,EAAE,WAAW;QACxB,aAAa,EAAE,OAAO,EAAE,+CAA+C;KACxE,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,0EAAuC,CAAC,MAAM,CAAC,CAAC,CAAC;IAE/F,MAAM,YAAY,GAAG;QACnB,aAAa,EAAE,CAAA,MAAA,QAAQ,CAAC,mBAAmB,0CAAE,aAAa,KAAI,OAAO;QACrE,WAAW,EAAE,CAAA,MAAA,QAAQ,CAAC,mBAAmB,0CAAE,WAAW,KAAI,mBAAmB;QAC7E,cAAc,EAAE,CAAA,MAAA,QAAQ,CAAC,mBAAmB,0CAAE,cAAc,KAAI,OAAO;KACvC,CAAC;IAEnC,OAAO,YAAY,CAAC;AACtB,CAAC,CAAA,CAAC;AAnBW,QAAA,4BAA4B,gCAmBvC","sourcesContent":["import { AuthenticationDeliveryDetails } from 'quidproquo-core';\n\nimport {\n  CognitoIdentityProviderClient,\n  GetUserAttributeVerificationCodeCommand,\n  GetUserAttributeVerificationCodeCommandInput,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\n\nexport const requestEmailVerificationCode = async (region: string, accessToken: string): Promise<AuthenticationDeliveryDetails> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params: GetUserAttributeVerificationCodeCommandInput = {\n    AccessToken: accessToken,\n    AttributeName: 'email', // Request verification for the email attribute\n  };\n\n  const response = await cognitoClient.send(new GetUserAttributeVerificationCodeCommand(params));\n\n  const deliveryInfo = {\n    attributeName: response.CodeDeliveryDetails?.AttributeName || 'email',\n    destination: response.CodeDeliveryDetails?.Destination || 'unknown@email.com',\n    deliveryMedium: response.CodeDeliveryDetails?.DeliveryMedium || 'EMAIL',\n  } as AuthenticationDeliveryDetails;\n\n  return deliveryInfo;\n};\n"]}
+{"version":3,"file":"requestEmailVerificationCode.js","sourceRoot":"","sources":["../../../../src/logic/cognito/requestEmailVerificationCode.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAImD;AAEnD,wDAAqD;AACrD,2HAAwH;AAEjH,MAAM,4BAA4B,GAAG,CAAO,MAAc,EAAE,WAAmB,EAA0C,EAAE;IAChI,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAAiD;QAC3D,WAAW,EAAE,WAAW;QACxB,aAAa,EAAE,OAAO;KACvB,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,0EAAuC,CAAC,MAAM,CAAC,CAAC,CAAC;IAE/F,OAAO,IAAA,+FAA8C,EAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;AACtF,CAAC,CAAA,CAAC;AAbW,QAAA,4BAA4B,gCAavC","sourcesContent":["import { AuthenticationDeliveryDetails } from 'quidproquo-core';\n\nimport {\n  CognitoIdentityProviderClient,\n  GetUserAttributeVerificationCodeCommand,\n  GetUserAttributeVerificationCodeCommandInput,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { cognitoCodeDeliveryDetailsToQpqDeliveryDetails } from './utils/cognitoCodeDeliveryDetailsToQpqDeliveryDetails';\n\nexport const requestEmailVerificationCode = async (region: string, accessToken: string): Promise<AuthenticationDeliveryDetails> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params: GetUserAttributeVerificationCodeCommandInput = {\n    AccessToken: accessToken,\n    AttributeName: 'email',\n  };\n\n  const response = await cognitoClient.send(new GetUserAttributeVerificationCodeCommand(params));\n\n  return cognitoCodeDeliveryDetailsToQpqDeliveryDetails(response.CodeDeliveryDetails);\n};\n"]}

package/lib/commonjs/logic/cognito/resolveUsernameByPreferredUsername.d.ts

@@ -1 +1,6 @@
+/**
+ * Resolves a login alias (preferred_username) to the real Cognito username.
+ * Falls back to the input when nothing matches, so callers can pass either a
+ * preferred username or an actual username.
+ */
 export declare const resolveUsernameByPreferredUsername: (userPoolId: string, region: string, preferredUsername: string) => Promise<string>;

package/lib/commonjs/logic/cognito/resolveUsernameByPreferredUsername.js

@@ -12,18 +12,41 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveUsernameByPreferredUsername = void 0;
 const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
 const createAwsClient_1 = require("../createAwsClient");
+const buildCognitoUserFilter_1 = require("./utils/buildCognitoUserFilter");
+// A value that cannot be embedded in a Cognito filter cannot be anyone's
+// preferred_username, so we skip the lookup and treat the input as an actual
+// username (the same fallback as a no-match lookup).
+const buildPreferredUsernameFilter = (preferredUsername) => {
+    try {
+        return (0, buildCognitoUserFilter_1.buildCognitoUserFilter)('preferred_username', preferredUsername);
+    }
+    catch (error) {
+        if (error instanceof buildCognitoUserFilter_1.InvalidCognitoFilterError) {
+            return null;
+        }
+        throw error;
+    }
+};
+/**
+ * Resolves a login alias (preferred_username) to the real Cognito username.
+ * Falls back to the input when nothing matches, so callers can pass either a
+ * preferred username or an actual username.
+ */
 const resolveUsernameByPreferredUsername = (userPoolId, region, preferredUsername) => __awaiter(void 0, void 0, void 0, function* () {
     var _a, _b;
+    const filter = buildPreferredUsernameFilter(preferredUsername);
+    if (!filter) {
+        return preferredUsername;
+    }
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
         region,
     });
     const response = yield cognitoClient.send(new client_cognito_identity_provider_1.ListUsersCommand({
         UserPoolId: userPoolId,
         Limit: 1,
-        Filter: `preferred_username = "${preferredUsername}"`,
+        Filter: filter,
     }));
-    const resolvedUsername = (_b = (_a = response.Users) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.Username;
-    return resolvedUsername || preferredUsername;
+    return ((_b = (_a = response.Users) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.Username) || preferredUsername;
 });
 exports.resolveUsernameByPreferredUsername = resolveUsernameByPreferredUsername;
 //# sourceMappingURL=resolveUsernameByPreferredUsername.js.map

package/lib/commonjs/logic/cognito/resolveUsernameByPreferredUsername.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolveUsernameByPreferredUsername.js","sourceRoot":"","sources":["../../../../src/logic/cognito/resolveUsernameByPreferredUsername.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gGAA4G;AAE5G,wDAAqD;AAE9C,MAAM,kCAAkC,GAAG,CAAO,UAAkB,EAAE,MAAc,EAAE,iBAAyB,EAAmB,EAAE;;IACzI,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CACvC,IAAI,mDAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,yBAAyB,iBAAiB,GAAG;KACtD,CAAC,CACH,CAAC;IAEF,MAAM,gBAAgB,GAAG,MAAA,MAAA,QAAQ,CAAC,KAAK,0CAAG,CAAC,CAAC,0CAAE,QAAQ,CAAC;IAEvD,OAAO,gBAAgB,IAAI,iBAAiB,CAAC;AAC/C,CAAC,CAAA,CAAC;AAhBW,QAAA,kCAAkC,sCAgB7C","sourcesContent":["import { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\n\nexport const resolveUsernameByPreferredUsername = async (userPoolId: string, region: string, preferredUsername: string): Promise<string> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      Limit: 1,\n      Filter: `preferred_username = \"${preferredUsername}\"`,\n    }),\n  );\n\n  const resolvedUsername = response.Users?.[0]?.Username;\n\n  return resolvedUsername || preferredUsername;\n};\n"]}
+{"version":3,"file":"resolveUsernameByPreferredUsername.js","sourceRoot":"","sources":["../../../../src/logic/cognito/resolveUsernameByPreferredUsername.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gGAA4G;AAE5G,wDAAqD;AACrD,2EAAmG;AAEnG,yEAAyE;AACzE,6EAA6E;AAC7E,qDAAqD;AACrD,MAAM,4BAA4B,GAAG,CAAC,iBAAyB,EAAiB,EAAE;IAChF,IAAI,CAAC;QACH,OAAO,IAAA,+CAAsB,EAAC,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,kDAAyB,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF;;;;GAIG;AACI,MAAM,kCAAkC,GAAG,CAAO,UAAkB,EAAE,MAAc,EAAE,iBAAyB,EAAmB,EAAE;;IACzI,MAAM,MAAM,GAAG,4BAA4B,CAAC,iBAAiB,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CACvC,IAAI,mDAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,MAAM;KACf,CAAC,CACH,CAAC;IAEF,OAAO,CAAA,MAAA,MAAA,QAAQ,CAAC,KAAK,0CAAG,CAAC,CAAC,0CAAE,QAAQ,KAAI,iBAAiB,CAAC;AAC5D,CAAC,CAAA,CAAC;AAnBW,QAAA,kCAAkC,sCAmB7C","sourcesContent":["import { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { buildCognitoUserFilter, InvalidCognitoFilterError } from './utils/buildCognitoUserFilter';\n\n// A value that cannot be embedded in a Cognito filter cannot be anyone's\n// preferred_username, so we skip the lookup and treat the input as an actual\n// username (the same fallback as a no-match lookup).\nconst buildPreferredUsernameFilter = (preferredUsername: string): string | null => {\n  try {\n    return buildCognitoUserFilter('preferred_username', preferredUsername);\n  } catch (error) {\n    if (error instanceof InvalidCognitoFilterError) {\n      return null;\n    }\n    throw error;\n  }\n};\n\n/**\n * Resolves a login alias (preferred_username) to the real Cognito username.\n * Falls back to the input when nothing matches, so callers can pass either a\n * preferred username or an actual username.\n */\nexport const resolveUsernameByPreferredUsername = async (userPoolId: string, region: string, preferredUsername: string): Promise<string> => {\n  const filter = buildPreferredUsernameFilter(preferredUsername);\n  if (!filter) {\n    return preferredUsername;\n  }\n\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      Limit: 1,\n      Filter: filter,\n    }),\n  );\n\n  return response.Users?.[0]?.Username || preferredUsername;\n};\n"]}

package/lib/commonjs/logic/cognito/respondToAuthChallenge.d.ts

@@ -0,0 +1,8 @@
+import { AuthenticateUserResponse } from 'quidproquo-core';
+import { ChallengeNameType } from '@aws-sdk/client-cognito-identity-provider';
+/**
+ * Answers a pending Cognito auth challenge (new password, TOTP code, custom
+ * challenge, ...) using the session from the previous auth step. Returns either
+ * issued tokens or the next challenge.
+ */
+export declare const respondToAuthChallenge: (userPoolId: string, clientId: string, region: string, username: string, session: string, challengeNameType: ChallengeNameType, attributes: Record<string, string>) => Promise<AuthenticateUserResponse>;

package/lib/commonjs/logic/cognito/{respondToAuthChallengeChallenge.js → respondToAuthChallenge.js}

@@ -9,13 +9,18 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.respondToAuthChallengeChallenge = void 0;
+exports.respondToAuthChallenge = void 0;
 const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
 const createAwsClient_1 = require("../createAwsClient");
 const calculateSecretHash_1 = require("./utils/calculateSecretHash");
-const transformCognitoResponse_1 = require("./utils/transformCognitoResponse");
+const cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo_1 = require("./utils/cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo");
 const getUserPoolClientSecret_1 = require("./getUserPoolClientSecret");
-const respondToAuthChallengeChallenge = (userPoolId, clientId, region, username, session, challengeNameType, attributes) => __awaiter(void 0, void 0, void 0, function* () {
+/**
+ * Answers a pending Cognito auth challenge (new password, TOTP code, custom
+ * challenge, ...) using the session from the previous auth step. Returns either
+ * issued tokens or the next challenge.
+ */
+const respondToAuthChallenge = (userPoolId, clientId, region, username, session, challengeNameType, attributes) => __awaiter(void 0, void 0, void 0, function* () {
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
         region,
     });
@@ -27,10 +32,11 @@ const respondToAuthChallengeChallenge = (userPoolId, clientId, region, username,
         Session: session,
         ChallengeResponses: Object.assign({ USERNAME: username, SECRET_HASH: secretHash }, attributes),
     };
+    // Token expiry is computed relative to this; captured before the call so the
+    // derived expiresAt errs early rather than late.
     const issueDateTime = new Date().toISOString();
     const response = yield cognitoClient.send(new client_cognito_identity_provider_1.RespondToAuthChallengeCommand(params));
-    // transform the response into your custom format, similar to your refreshToken function
-    return (0, transformCognitoResponse_1.cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo)(response, issueDateTime);
+    return (0, cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo_1.cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo)(response, issueDateTime);
 });
-exports.respondToAuthChallengeChallenge = respondToAuthChallengeChallenge;
-//# sourceMappingURL=respondToAuthChallengeChallenge.js.map
+exports.respondToAuthChallenge = respondToAuthChallenge;
+//# sourceMappingURL=respondToAuthChallenge.js.map

package/lib/commonjs/logic/cognito/respondToAuthChallenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"respondToAuthChallenge.js","sourceRoot":"","sources":["../../../../src/logic/cognito/respondToAuthChallenge.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAKmD;AAEnD,wDAAqD;AACrD,qEAAkE;AAClE,6IAA0I;AAC1I,uEAAoE;AAEpE;;;;GAIG;AACI,MAAM,sBAAsB,GAAG,CACpC,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,QAAgB,EAChB,OAAe,EACf,iBAAoC,EACpC,UAAkC,EACC,EAAE;IACrC,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,IAAA,iDAAuB,EAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,IAAA,yCAAmB,EAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAuC;QACjD,aAAa,EAAE,iBAAiB;QAChC,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,OAAO;QAChB,kBAAkB,kBAChB,QAAQ,EAAE,QAAQ,EAClB,WAAW,EAAE,UAAU,IAEpB,UAAU,CACd;KACF,CAAC;IAEF,6EAA6E;IAC7E,iDAAiD;IACjD,MAAM,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,gEAA6B,CAAC,MAAM,CAAC,CAAC,CAAC;IAErF,OAAO,IAAA,iHAAuD,EAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AAC1F,CAAC,CAAA,CAAC;AAlCW,QAAA,sBAAsB,0BAkCjC","sourcesContent":["import { AuthenticateUserResponse } from 'quidproquo-core';\n\nimport {\n  ChallengeNameType,\n  CognitoIdentityProviderClient,\n  RespondToAuthChallengeCommand,\n  RespondToAuthChallengeCommandInput,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo } from './utils/cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\n/**\n * Answers a pending Cognito auth challenge (new password, TOTP code, custom\n * challenge, ...) using the session from the previous auth step. Returns either\n * issued tokens or the next challenge.\n */\nexport const respondToAuthChallenge = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  username: string,\n  session: string,\n  challengeNameType: ChallengeNameType,\n  attributes: Record<string, string>,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  const params: RespondToAuthChallengeCommandInput = {\n    ChallengeName: challengeNameType,\n    ClientId: clientId,\n    Session: session,\n    ChallengeResponses: {\n      USERNAME: username,\n      SECRET_HASH: secretHash,\n\n      ...attributes,\n    },\n  };\n\n  // Token expiry is computed relative to this; captured before the call so the\n  // derived expiresAt errs early rather than late.\n  const issueDateTime = new Date().toISOString();\n  const response = await cognitoClient.send(new RespondToAuthChallengeCommand(params));\n\n  return cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo(response, issueDateTime);\n};\n"]}

package/lib/commonjs/logic/cognito/setUserAttributes.js

@@ -23,18 +23,18 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.setUserAttributes = void 0;
 const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
 const createAwsClient_1 = require("../createAwsClient");
-const cognitoAttributeMap_1 = require("./cognitoAttributeMap");
+const getCognitoUserAttributesFromQpqUserAttributes_1 = require("./getCognitoUserAttributesFromQpqUserAttributes");
 const setUserAttributes = (userPoolId, region, username, userAttributes) => __awaiter(void 0, void 0, void 0, function* () {
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
         region,
     });
+    // userId maps to the immutable sub attribute, so it must never be written back.
     const { userId } = userAttributes, writeableUserAttributes = __rest(userAttributes, ["userId"]);
-    const params = {
+    yield cognitoClient.send(new client_cognito_identity_provider_1.AdminUpdateUserAttributesCommand({
         UserPoolId: userPoolId,
         Username: username,
-        UserAttributes: (0, cognitoAttributeMap_1.getCognitoUserAttributesFromQpqUserAttributes)(writeableUserAttributes),
-    };
-    yield cognitoClient.send(new client_cognito_identity_provider_1.AdminUpdateUserAttributesCommand(params));
+        UserAttributes: (0, getCognitoUserAttributesFromQpqUserAttributes_1.getCognitoUserAttributesFromQpqUserAttributes)(writeableUserAttributes),
+    }));
 });
 exports.setUserAttributes = setUserAttributes;
 //# sourceMappingURL=setUserAttributes.js.map

package/lib/commonjs/logic/cognito/setUserAttributes.js.map

@@ -1 +1 @@
-{"version":3,"file":"setUserAttributes.js","sourceRoot":"","sources":["../../../../src/logic/cognito/setUserAttributes.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAEA,gGAA2I;AAE3I,wDAAqD;AACrD,+DAAsF;AAE/E,MAAM,iBAAiB,GAAG,CAAO,UAAkB,EAAE,MAAc,EAAE,QAAgB,EAAE,cAA8B,EAAiB,EAAE;IAC7I,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,EAAE,MAAM,KAAiC,cAAc,EAA1C,uBAAuB,UAAK,cAAc,EAAvD,UAAsC,CAAiB,CAAC;IAE9D,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAClB,cAAc,EAAE,IAAA,mEAA6C,EAAC,uBAAuB,CAAC;KACvF,CAAC;IAEF,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,mEAAgC,CAAC,MAAM,CAAC,CAAC,CAAC;AACzE,CAAC,CAAA,CAAC;AAdW,QAAA,iBAAiB,qBAc5B","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { AdminUpdateUserAttributesCommand, AttributeType, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getCognitoUserAttributesFromQpqUserAttributes } from './cognitoAttributeMap';\n\nexport const setUserAttributes = async (userPoolId: string, region: string, username: string, userAttributes: UserAttributes): Promise<void> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const { userId, ...writeableUserAttributes } = userAttributes;\n\n  const params = {\n    UserPoolId: userPoolId,\n    Username: username,\n    UserAttributes: getCognitoUserAttributesFromQpqUserAttributes(writeableUserAttributes),\n  };\n\n  await cognitoClient.send(new AdminUpdateUserAttributesCommand(params));\n};\n"]}
+{"version":3,"file":"setUserAttributes.js","sourceRoot":"","sources":["../../../../src/logic/cognito/setUserAttributes.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAEA,gGAA4H;AAE5H,wDAAqD;AACrD,mHAAgH;AAEzG,MAAM,iBAAiB,GAAG,CAAO,UAAkB,EAAE,MAAc,EAAE,QAAgB,EAAE,cAA8B,EAAiB,EAAE;IAC7I,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,gFAAgF;IAChF,MAAM,EAAE,MAAM,KAAiC,cAAc,EAA1C,uBAAuB,UAAK,cAAc,EAAvD,UAAsC,CAAiB,CAAC;IAE9D,MAAM,aAAa,CAAC,IAAI,CACtB,IAAI,mEAAgC,CAAC;QACnC,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAClB,cAAc,EAAE,IAAA,6FAA6C,EAAC,uBAAuB,CAAC;KACvF,CAAC,CACH,CAAC;AACJ,CAAC,CAAA,CAAC;AAfW,QAAA,iBAAiB,qBAe5B","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { AdminUpdateUserAttributesCommand, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getCognitoUserAttributesFromQpqUserAttributes } from './getCognitoUserAttributesFromQpqUserAttributes';\n\nexport const setUserAttributes = async (userPoolId: string, region: string, username: string, userAttributes: UserAttributes): Promise<void> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  // userId maps to the immutable sub attribute, so it must never be written back.\n  const { userId, ...writeableUserAttributes } = userAttributes;\n\n  await cognitoClient.send(\n    new AdminUpdateUserAttributesCommand({\n      UserPoolId: userPoolId,\n      Username: username,\n      UserAttributes: getCognitoUserAttributesFromQpqUserAttributes(writeableUserAttributes),\n    }),\n  );\n};\n"]}

package/lib/commonjs/logic/cognito/setUserPassword.js

@@ -16,11 +16,12 @@ const setUserPassword = (region, userPoolId, username, password) => __awaiter(vo
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
         region,
     });
-    // There has to be a better way than this?
     const passwordParams = {
         Password: password,
         Username: username,
         UserPoolId: userPoolId,
+        // Activate the password immediately rather than leaving the user in the
+        // FORCE_CHANGE_PASSWORD state a temporary password would.
         Permanent: true,
     };
     yield cognitoClient.send(new client_cognito_identity_provider_1.AdminSetUserPasswordCommand(passwordParams));

package/lib/commonjs/logic/cognito/setUserPassword.js.map

@@ -1 +1 @@
-{"version":3,"file":"setUserPassword.js","sourceRoot":"","sources":["../../../../src/logic/cognito/setUserPassword.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gGAImD;AAEnD,wDAAqD;AAE9C,MAAM,eAAe,GAAG,CAAO,MAAc,EAAE,UAAkB,EAAE,QAAgB,EAAE,QAAgB,EAAE,EAAE;IAC9G,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,0CAA0C;IAC1C,MAAM,cAAc,GAAqC;QACvD,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,UAAU;QACtB,SAAS,EAAE,IAAI;KAChB,CAAC;IAEF,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,8DAA2B,CAAC,cAAc,CAAC,CAAC,CAAC;AAC5E,CAAC,CAAA,CAAC;AAdW,QAAA,eAAe,mBAc1B","sourcesContent":["import {\n  AdminSetUserPasswordCommand,\n  AdminSetUserPasswordCommandInput,\n  CognitoIdentityProviderClient,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\n\nexport const setUserPassword = async (region: string, userPoolId: string, username: string, password: string) => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  // There has to be a better way than this?\n  const passwordParams: AdminSetUserPasswordCommandInput = {\n    Password: password,\n    Username: username,\n    UserPoolId: userPoolId,\n    Permanent: true,\n  };\n\n  await cognitoClient.send(new AdminSetUserPasswordCommand(passwordParams));\n};\n"]}
+{"version":3,"file":"setUserPassword.js","sourceRoot":"","sources":["../../../../src/logic/cognito/setUserPassword.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gGAImD;AAEnD,wDAAqD;AAE9C,MAAM,eAAe,GAAG,CAAO,MAAc,EAAE,UAAkB,EAAE,QAAgB,EAAE,QAAgB,EAAiB,EAAE;IAC7H,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,cAAc,GAAqC;QACvD,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,UAAU;QACtB,wEAAwE;QACxE,0DAA0D;QAC1D,SAAS,EAAE,IAAI;KAChB,CAAC;IAEF,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,8DAA2B,CAAC,cAAc,CAAC,CAAC,CAAC;AAC5E,CAAC,CAAA,CAAC;AAfW,QAAA,eAAe,mBAe1B","sourcesContent":["import {\n  AdminSetUserPasswordCommand,\n  AdminSetUserPasswordCommandInput,\n  CognitoIdentityProviderClient,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\n\nexport const setUserPassword = async (region: string, userPoolId: string, username: string, password: string): Promise<void> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const passwordParams: AdminSetUserPasswordCommandInput = {\n    Password: password,\n    Username: username,\n    UserPoolId: userPoolId,\n    // Activate the password immediately rather than leaving the user in the\n    // FORCE_CHANGE_PASSWORD state a temporary password would.\n    Permanent: true,\n  };\n\n  await cognitoClient.send(new AdminSetUserPasswordCommand(passwordParams));\n};\n"]}

package/lib/commonjs/logic/cognito/utils/CognitoUserAttribute.d.ts

@@ -0,0 +1,5 @@
+/** A Cognito user attribute that is guaranteed to carry both a name and a value. */
+export type CognitoUserAttribute = {
+    Name: string;
+    Value: string;
+};

package/lib/commonjs/logic/cognito/utils/CognitoUserAttribute.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=CognitoUserAttribute.js.map

package/lib/commonjs/logic/cognito/utils/CognitoUserAttribute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CognitoUserAttribute.js","sourceRoot":"","sources":["../../../../../src/logic/cognito/utils/CognitoUserAttribute.ts"],"names":[],"mappings":"","sourcesContent":["/** A Cognito user attribute that is guaranteed to carry both a name and a value. */\nexport type CognitoUserAttribute = {\n  Name: string;\n  Value: string;\n};\n"]}

package/lib/commonjs/logic/cognito/utils/buildCognitoUserFilter.d.ts

@@ -0,0 +1,10 @@
+export declare class InvalidCognitoFilterError extends Error {
+    readonly code = "INVALID_COGNITO_FILTER";
+    constructor(message: string);
+}
+/**
+ * Builds a Cognito ListUsers exact-match filter (`name = "value"`), rejecting
+ * attribute names and values that cannot be embedded safely.
+ * Throws InvalidCognitoFilterError (code INVALID_COGNITO_FILTER) on unsafe input.
+ */
+export declare const buildCognitoUserFilter: (attributeName: string, attributeValue: string) => string;

package/lib/commonjs/logic/cognito/utils/buildCognitoUserFilter.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildCognitoUserFilter = exports.InvalidCognitoFilterError = void 0;
+// ListUsers filter strings are built by interpolation, so a value containing a
+// quote or backslash could break out of the quoted literal and alter the filter.
+// Cognito defines no escaping for these, so unsafe input is rejected outright.
+class InvalidCognitoFilterError extends Error {
+    constructor(message) {
+        super(message);
+        this.code = 'INVALID_COGNITO_FILTER';
+        this.name = 'InvalidCognitoFilterError';
+    }
+}
+exports.InvalidCognitoFilterError = InvalidCognitoFilterError;
+// Cognito filterable attribute names: standard attributes plus prefixed ones
+// like cognito:user_status.
+const validAttributeName = /^[a-zA-Z][a-zA-Z0-9_:]*$/;
+/**
+ * Builds a Cognito ListUsers exact-match filter (`name = "value"`), rejecting
+ * attribute names and values that cannot be embedded safely.
+ * Throws InvalidCognitoFilterError (code INVALID_COGNITO_FILTER) on unsafe input.
+ */
+const buildCognitoUserFilter = (attributeName, attributeValue) => {
+    if (!validAttributeName.test(attributeName)) {
+        throw new InvalidCognitoFilterError(`Invalid Cognito filter attribute name: ${attributeName}`);
+    }
+    // The value is deliberately not echoed into the message: it can be user input.
+    if (attributeValue.includes('"') || attributeValue.includes('\\')) {
+        throw new InvalidCognitoFilterError('Cognito filter values cannot contain quotes or backslashes');
+    }
+    return `${attributeName} = "${attributeValue}"`;
+};
+exports.buildCognitoUserFilter = buildCognitoUserFilter;
+//# sourceMappingURL=buildCognitoUserFilter.js.map

package/lib/commonjs/logic/cognito/utils/buildCognitoUserFilter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildCognitoUserFilter.js","sourceRoot":"","sources":["../../../../../src/logic/cognito/utils/buildCognitoUserFilter.ts"],"names":[],"mappings":";;;AAAA,+EAA+E;AAC/E,iFAAiF;AACjF,+EAA+E;AAC/E,MAAa,yBAA0B,SAAQ,KAAK;IAGlD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QAHR,SAAI,GAAG,wBAAwB,CAAC;QAIvC,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAPD,8DAOC;AAED,6EAA6E;AAC7E,4BAA4B;AAC5B,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAEtD;;;;GAIG;AACI,MAAM,sBAAsB,GAAG,CAAC,aAAqB,EAAE,cAAsB,EAAU,EAAE;IAC9F,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,yBAAyB,CAAC,0CAA0C,aAAa,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,+EAA+E;IAC/E,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,yBAAyB,CAAC,4DAA4D,CAAC,CAAC;IACpG,CAAC;IAED,OAAO,GAAG,aAAa,OAAO,cAAc,GAAG,CAAC;AAClD,CAAC,CAAC;AAXW,QAAA,sBAAsB,0BAWjC","sourcesContent":["// ListUsers filter strings are built by interpolation, so a value containing a\n// quote or backslash could break out of the quoted literal and alter the filter.\n// Cognito defines no escaping for these, so unsafe input is rejected outright.\nexport class InvalidCognitoFilterError extends Error {\n  readonly code = 'INVALID_COGNITO_FILTER';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'InvalidCognitoFilterError';\n  }\n}\n\n// Cognito filterable attribute names: standard attributes plus prefixed ones\n// like cognito:user_status.\nconst validAttributeName = /^[a-zA-Z][a-zA-Z0-9_:]*$/;\n\n/**\n * Builds a Cognito ListUsers exact-match filter (`name = \"value\"`), rejecting\n * attribute names and values that cannot be embedded safely.\n * Throws InvalidCognitoFilterError (code INVALID_COGNITO_FILTER) on unsafe input.\n */\nexport const buildCognitoUserFilter = (attributeName: string, attributeValue: string): string => {\n  if (!validAttributeName.test(attributeName)) {\n    throw new InvalidCognitoFilterError(`Invalid Cognito filter attribute name: ${attributeName}`);\n  }\n\n  // The value is deliberately not echoed into the message: it can be user input.\n  if (attributeValue.includes('\"') || attributeValue.includes('\\\\')) {\n    throw new InvalidCognitoFilterError('Cognito filter values cannot contain quotes or backslashes');\n  }\n\n  return `${attributeName} = \"${attributeValue}\"`;\n};\n"]}

package/lib/commonjs/logic/cognito/utils/calculateSecretHash.d.ts

@@ -1 +1,6 @@
+/**
+ * Computes the Cognito SECRET_HASH for an app client with a secret: the base64
+ * HMAC-SHA256 of username + clientId, keyed by the client secret. Memoized
+ * because every auth call for the same user recomputes the same value.
+ */
 export declare const calculateSecretHash: (username: string, clientId: string, clientSecret: string) => string;

package/lib/commonjs/logic/cognito/utils/calculateSecretHash.js

@@ -3,12 +3,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.calculateSecretHash = void 0;
 const crypto_1 = require("crypto");
 const memoFunc_1 = require("../../cache/memoFunc");
+/**
+ * Computes the Cognito SECRET_HASH for an app client with a secret: the base64
+ * HMAC-SHA256 of username + clientId, keyed by the client secret. Memoized
+ * because every auth call for the same user recomputes the same value.
+ */
 exports.calculateSecretHash = (0, memoFunc_1.memoFunc)((username, clientId, clientSecret) => {
-    // create the hmac with the sha256 algorithm and a secret key
-    const hasher = (0, crypto_1.createHmac)('sha256', clientSecret);
-    // add the value we want to hash
-    hasher.update(`${username}${clientId}`);
-    // get the hashed value as base64
-    return hasher.digest('base64');
+    return (0, crypto_1.createHmac)('sha256', clientSecret).update(`${username}${clientId}`).digest('base64');
 });
 //# sourceMappingURL=calculateSecretHash.js.map

package/lib/commonjs/logic/cognito/utils/calculateSecretHash.js.map

@@ -1 +1 @@
-{"version":3,"file":"calculateSecretHash.js","sourceRoot":"","sources":["../../../../../src/logic/cognito/utils/calculateSecretHash.ts"],"names":[],"mappings":";;;AAAA,mCAAoC;AAEpC,mDAAgD;AAEnC,QAAA,mBAAmB,GAAG,IAAA,mBAAQ,EAAC,CAAC,QAAgB,EAAE,QAAgB,EAAE,YAAoB,EAAE,EAAE;IACvG,6DAA6D;IAC7D,MAAM,MAAM,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAElD,gCAAgC;IAChC,MAAM,CAAC,MAAM,CAAC,GAAG,QAAQ,GAAG,QAAQ,EAAE,CAAC,CAAC;IAExC,iCAAiC;IACjC,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC,CAAC,CAAC","sourcesContent":["import { createHmac } from 'crypto';\n\nimport { memoFunc } from '../../cache/memoFunc';\n\nexport const calculateSecretHash = memoFunc((username: string, clientId: string, clientSecret: string) => {\n  // create the hmac with the sha256 algorithm and a secret key\n  const hasher = createHmac('sha256', clientSecret);\n\n  // add the value we want to hash\n  hasher.update(`${username}${clientId}`);\n\n  // get the hashed value as base64\n  return hasher.digest('base64');\n});\n"]}
+{"version":3,"file":"calculateSecretHash.js","sourceRoot":"","sources":["../../../../../src/logic/cognito/utils/calculateSecretHash.ts"],"names":[],"mappings":";;;AAAA,mCAAoC;AAEpC,mDAAgD;AAEhD;;;;GAIG;AACU,QAAA,mBAAmB,GAAG,IAAA,mBAAQ,EAAC,CAAC,QAAgB,EAAE,QAAgB,EAAE,YAAoB,EAAU,EAAE;IAC/G,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,GAAG,QAAQ,GAAG,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC9F,CAAC,CAAC,CAAC","sourcesContent":["import { createHmac } from 'crypto';\n\nimport { memoFunc } from '../../cache/memoFunc';\n\n/**\n * Computes the Cognito SECRET_HASH for an app client with a secret: the base64\n * HMAC-SHA256 of username + clientId, keyed by the client secret. Memoized\n * because every auth call for the same user recomputes the same value.\n */\nexport const calculateSecretHash = memoFunc((username: string, clientId: string, clientSecret: string): string => {\n  return createHmac('sha256', clientSecret).update(`${username}${clientId}`).digest('base64');\n});\n"]}

package/lib/commonjs/logic/cognito/utils/cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo.d.ts

@@ -0,0 +1,8 @@
+import { AuthenticateUserResponse } from 'quidproquo-core';
+import { AdminInitiateAuthResponse } from '@aws-sdk/client-cognito-identity-provider';
+/**
+ * Maps a Cognito InitiateAuth/RespondToAuthChallenge response onto the qpq
+ * AuthenticateUserResponse: pending-challenge state plus, once Cognito issues
+ * tokens, the authentication info with expiry anchored to issueDateTime.
+ */
+export declare const cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo: (authResponse: AdminInitiateAuthResponse, issueDateTime: string) => AuthenticateUserResponse;