quidproquo-actionprocessor-awslambda 0.1.11 → 0.1.13

package/lib/esm/logic/cognito/authenticateUser.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticateUser.js","sourceRoot":"","sources":["../../../../src/logic/cognito/authenticateUser.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,wBAAwB,EAExB,YAAY,EACZ,6BAA6B,GAC9B,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,uDAAuD,EAAE,MAAM,kCAAkC,CAAC;AAC3G,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,2CAA2C;AAE3C,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,QAAiB,EACjB,QAAgB,EAChB,QAAiB,EACkB,EAAE;IACrC,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,6BAA6B;IAC7B,MAAM,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE/C,MAAM,MAAM,GAAkC;QAC5C,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,wBAAwB;QACrF,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAElB,cAAc,EAAE;YACd,QAAQ,EAAE,QAAQ;YAClB,WAAW,EAAE,UAAU;SACxB;KACF,CAAC;IAEF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,cAAe,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC7C,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhF,OAAO,uDAAuD,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AAC1F,CAAC,CAAC","sourcesContent":["import { AuthenticateUserChallenge, AuthenticateUserResponse, UserDirectoryAuthenticateUserActionPayload } from 'quidproquo-core';\n\nimport {\n  AdminInitiateAuthCommand,\n  AdminInitiateAuthCommandInput,\n  AuthFlowType,\n  CognitoIdentityProviderClient,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo } from './utils/transformCognitoResponse';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\n// TODO: retry for TooManyRequestsException\n\nexport const authenticateUser = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  isCustom: boolean,\n  username: string,\n  password?: string,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  // Time we issued the request\n  const issueDateTime = new Date().toISOString();\n\n  const params: AdminInitiateAuthCommandInput = {\n    AuthFlow: isCustom ? AuthFlowType.CUSTOM_AUTH : AuthFlowType.ADMIN_USER_PASSWORD_AUTH,\n    UserPoolId: userPoolId,\n    ClientId: clientId,\n\n    AuthParameters: {\n      USERNAME: username,\n      SECRET_HASH: secretHash,\n    },\n  };\n\n  if (password) {\n    params.AuthParameters!.PASSWORD = password;\n  }\n\n  const response = await cognitoClient.send(new AdminInitiateAuthCommand(params));\n\n  return cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo(response, issueDateTime);\n};\n"]}
+{"version":3,"file":"authenticateUser.js","sourceRoot":"","sources":["../../../../src/logic/cognito/authenticateUser.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,wBAAwB,EAExB,YAAY,EACZ,6BAA6B,GAC9B,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,uDAAuD,EAAE,MAAM,iEAAiE,CAAC;AAC1I,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,2CAA2C;AAE3C;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,QAAiB,EACjB,QAAgB,EAChB,QAAiB,EACkB,EAAE;IACrC,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,6EAA6E;IAC7E,iDAAiD;IACjD,MAAM,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE/C,MAAM,MAAM,GAAkC;QAC5C,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,wBAAwB;QACrF,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAElB,cAAc,EAAE;YACd,QAAQ,EAAE,QAAQ;YAClB,WAAW,EAAE,UAAU;SACxB;KACF,CAAC;IAEF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,cAAe,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC7C,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhF,OAAO,uDAAuD,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AAC1F,CAAC,CAAC","sourcesContent":["import { AuthenticateUserResponse } from 'quidproquo-core';\n\nimport {\n  AdminInitiateAuthCommand,\n  AdminInitiateAuthCommandInput,\n  AuthFlowType,\n  CognitoIdentityProviderClient,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo } from './utils/cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\n// TODO: retry for TooManyRequestsException\n\n/**\n * Starts a Cognito auth flow (password auth, or CUSTOM_AUTH when isCustom) and\n * returns the qpq response: either issued tokens or a pending challenge.\n */\nexport const authenticateUser = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  isCustom: boolean,\n  username: string,\n  password?: string,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  // Token expiry is computed relative to this; captured before the call so the\n  // derived expiresAt errs early rather than late.\n  const issueDateTime = new Date().toISOString();\n\n  const params: AdminInitiateAuthCommandInput = {\n    AuthFlow: isCustom ? AuthFlowType.CUSTOM_AUTH : AuthFlowType.ADMIN_USER_PASSWORD_AUTH,\n    UserPoolId: userPoolId,\n    ClientId: clientId,\n\n    AuthParameters: {\n      USERNAME: username,\n      SECRET_HASH: secretHash,\n    },\n  };\n\n  if (password) {\n    params.AuthParameters!.PASSWORD = password;\n  }\n\n  const response = await cognitoClient.send(new AdminInitiateAuthCommand(params));\n\n  return cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo(response, issueDateTime);\n};\n"]}

package/lib/esm/logic/cognito/cognitoAttributeMap.d.ts

@@ -1,11 +1,3 @@
 import { UserAttributes } from 'quidproquo-core';
+/** Maps qpq UserAttributes keys to their Cognito standard attribute names. */
 export declare const cognitoAttributeMap: Record<keyof UserAttributes, string>;
-export declare const getCognitoUserAttributesFromQpqUserAttributes: (userAttributes: UserAttributes) => {
-    Name: string;
-    Value: string;
-}[];
-export declare const getQpqAttributesFromCognitoUserAttributes: (cognitoUserAttributes: {
-    Name: string;
-    Value: string;
-}[]) => UserAttributes;
-export declare const getQpqAttributesFromCognitoStringMap: (cognitoUserAttributes: Record<string, string>) => UserAttributes;

package/lib/esm/logic/cognito/cognitoAttributeMap.js

@@ -1,3 +1,4 @@
+/** Maps qpq UserAttributes keys to their Cognito standard attribute names. */
 export const cognitoAttributeMap = {
     email: 'email',
     emailVerified: 'email_verified',
@@ -18,42 +19,4 @@ export const cognitoAttributeMap = {
     website: 'website',
     zoneInfo: 'zoneinfo',
 };
-// Flip the cognitoAttributeMap for reverse mapping
-const reversedCognitoAttributeMap = Object.entries(cognitoAttributeMap).reduce((acc, [key, value]) => ({ ...acc, [value]: key }), {});
-export const getCognitoUserAttributesFromQpqUserAttributes = (userAttributes) => {
-    return Object.keys(userAttributes)
-        .map((key) => ({
-        Name: cognitoAttributeMap[key],
-        Value: `${userAttributes[key]}`,
-    }))
-        .filter((attribute) => !!attribute.Name && !!attribute.Value);
-};
-const getQpqAttributeObjectFromCognitoKeyValue = (key, value) => {
-    const userAttributeKey = reversedCognitoAttributeMap[key];
-    if (!userAttributeKey) {
-        return {}; // If there's no matching key in your mapping, just return nothing
-    }
-    if (userAttributeKey === 'emailVerified') {
-        // Assume the value of 'email_verified' is a string of 'true' or 'false'
-        return { [userAttributeKey]: value === 'true' };
-    }
-    return { [userAttributeKey]: value };
-};
-export const getQpqAttributesFromCognitoUserAttributes = (cognitoUserAttributes) => {
-    // Map cognitoUserAttributes to your UserAttributes format
-    const userAttributes = cognitoUserAttributes.reduce((acc, { Name, Value }) => {
-        return {
-            ...acc,
-            ...getQpqAttributeObjectFromCognitoKeyValue(Name, Value),
-        };
-    }, {});
-    return userAttributes;
-};
-export const getQpqAttributesFromCognitoStringMap = (cognitoUserAttributes) => {
-    const userAttributes = Object.keys(cognitoUserAttributes).reduce((acc, key) => ({
-        ...acc,
-        ...getQpqAttributeObjectFromCognitoKeyValue(key, cognitoUserAttributes[key]),
-    }), {});
-    return userAttributes;
-};
 //# sourceMappingURL=cognitoAttributeMap.js.map

package/lib/esm/logic/cognito/cognitoAttributeMap.js.map

@@ -1 +1 @@
-{"version":3,"file":"cognitoAttributeMap.js","sourceRoot":"","sources":["../../../../src/logic/cognito/cognitoAttributeMap.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,mBAAmB,GAAyC;IACvE,KAAK,EAAE,OAAO;IACd,aAAa,EAAE,gBAAgB;IAC/B,MAAM,EAAE,KAAK;IAEb,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,WAAW;IACtB,UAAU,EAAE,aAAa;IACzB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,YAAY;IACvB,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,aAAa;IACzB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,WAAW,EAAE,cAAc;IAC3B,OAAO,EAAE,SAAS;IAClB,iBAAiB,EAAE,oBAAoB;IACvC,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;CACrB,CAAC;AAEF,mDAAmD;AACnD,MAAM,2BAA2B,GAAyC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAClH,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,EACjD,EAAE,CACH,CAAC;AAEF,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,cAA8B,EAAE,EAAE;IAC9F,OAAO,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC;SAC/B,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACb,IAAI,EAAE,mBAAmB,CAAC,GAA2B,CAAC;QACtD,KAAK,EAAE,GAAG,cAAc,CAAC,GAA2B,CAAC,EAAE;KACxD,CAAC,CAAC;SACF,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC,CAAC;AAEF,MAAM,wCAAwC,GAAG,CAAC,GAAW,EAAE,KAAa,EAAkB,EAAE;IAC9F,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAE1D,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC,CAAC,kEAAkE;IAC/E,CAAC;IAED,IAAI,gBAAgB,KAAK,eAAe,EAAE,CAAC;QACzC,wEAAwE;QACxE,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE,KAAK,KAAK,MAAM,EAAE,CAAC;IAClD,CAAC;IAED,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC;AACvC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,qBAAwD,EAAkB,EAAE;IACpI,0DAA0D;IAC1D,MAAM,cAAc,GAAmB,qBAAqB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QAC3F,OAAO;YACL,GAAG,GAAG;YACN,GAAG,wCAAwC,CAAC,IAAI,EAAE,KAAK,CAAC;SACzD,CAAC;IACJ,CAAC,EAAE,EAAoB,CAAC,CAAC;IAEzB,OAAO,cAAc,CAAC;AACxB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,qBAA6C,EAAkB,EAAE;IACpH,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAC9D,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACb,GAAG,GAAG;QACN,GAAG,wCAAwC,CAAC,GAAG,EAAE,qBAAqB,CAAC,GAAG,CAAC,CAAC;KAC7E,CAAC,EACF,EAAoB,CACrB,CAAC;IAEF,OAAO,cAAc,CAAC;AACxB,CAAC,CAAC","sourcesContent":["import { CreateUserRequest, UserAttributes } from 'quidproquo-core';\n\nexport const cognitoAttributeMap: Record<keyof UserAttributes, string> = {\n  email: 'email',\n  emailVerified: 'email_verified',\n  userId: 'sub',\n\n  address: 'address',\n  birthDate: 'birthdate',\n  familyName: 'family_name',\n  gender: 'gender',\n  givenName: 'given_name',\n  locale: 'locale',\n  middleName: 'middle_name',\n  name: 'name',\n  nickname: 'nickname',\n  phoneNumber: 'phone_number',\n  picture: 'picture',\n  preferredUsername: 'preferred_username',\n  profile: 'profile',\n  website: 'website',\n  zoneInfo: 'zoneinfo',\n};\n\n// Flip the cognitoAttributeMap for reverse mapping\nconst reversedCognitoAttributeMap: Record<string, keyof UserAttributes> = Object.entries(cognitoAttributeMap).reduce(\n  (acc, [key, value]) => ({ ...acc, [value]: key }),\n  {},\n);\n\nexport const getCognitoUserAttributesFromQpqUserAttributes = (userAttributes: UserAttributes) => {\n  return Object.keys(userAttributes)\n    .map((key) => ({\n      Name: cognitoAttributeMap[key as keyof UserAttributes],\n      Value: `${userAttributes[key as keyof UserAttributes]}`,\n    }))\n    .filter((attribute) => !!attribute.Name && !!attribute.Value);\n};\n\nconst getQpqAttributeObjectFromCognitoKeyValue = (key: string, value: string): UserAttributes => {\n  const userAttributeKey = reversedCognitoAttributeMap[key];\n\n  if (!userAttributeKey) {\n    return {}; // If there's no matching key in your mapping, just return nothing\n  }\n\n  if (userAttributeKey === 'emailVerified') {\n    // Assume the value of 'email_verified' is a string of 'true' or 'false'\n    return { [userAttributeKey]: value === 'true' };\n  }\n\n  return { [userAttributeKey]: value };\n};\n\nexport const getQpqAttributesFromCognitoUserAttributes = (cognitoUserAttributes: { Name: string; Value: string }[]): UserAttributes => {\n  // Map cognitoUserAttributes to your UserAttributes format\n  const userAttributes: UserAttributes = cognitoUserAttributes.reduce((acc, { Name, Value }) => {\n    return {\n      ...acc,\n      ...getQpqAttributeObjectFromCognitoKeyValue(Name, Value),\n    };\n  }, {} as UserAttributes);\n\n  return userAttributes;\n};\n\nexport const getQpqAttributesFromCognitoStringMap = (cognitoUserAttributes: Record<string, string>): UserAttributes => {\n  const userAttributes = Object.keys(cognitoUserAttributes).reduce(\n    (acc, key) => ({\n      ...acc,\n      ...getQpqAttributeObjectFromCognitoKeyValue(key, cognitoUserAttributes[key]),\n    }),\n    {} as UserAttributes,\n  );\n\n  return userAttributes;\n};\n"]}
+{"version":3,"file":"cognitoAttributeMap.js","sourceRoot":"","sources":["../../../../src/logic/cognito/cognitoAttributeMap.ts"],"names":[],"mappings":"AAEA,8EAA8E;AAC9E,MAAM,CAAC,MAAM,mBAAmB,GAAyC;IACvE,KAAK,EAAE,OAAO;IACd,aAAa,EAAE,gBAAgB;IAC/B,MAAM,EAAE,KAAK;IAEb,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,WAAW;IACtB,UAAU,EAAE,aAAa;IACzB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,YAAY;IACvB,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,aAAa;IACzB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,WAAW,EAAE,cAAc;IAC3B,OAAO,EAAE,SAAS;IAClB,iBAAiB,EAAE,oBAAoB;IACvC,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;CACrB,CAAC","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\n/** Maps qpq UserAttributes keys to their Cognito standard attribute names. */\nexport const cognitoAttributeMap: Record<keyof UserAttributes, string> = {\n  email: 'email',\n  emailVerified: 'email_verified',\n  userId: 'sub',\n\n  address: 'address',\n  birthDate: 'birthdate',\n  familyName: 'family_name',\n  gender: 'gender',\n  givenName: 'given_name',\n  locale: 'locale',\n  middleName: 'middle_name',\n  name: 'name',\n  nickname: 'nickname',\n  phoneNumber: 'phone_number',\n  picture: 'picture',\n  preferredUsername: 'preferred_username',\n  profile: 'profile',\n  website: 'website',\n  zoneInfo: 'zoneinfo',\n};\n"]}

package/lib/esm/logic/cognito/confirmForgotPassword.d.ts

@@ -1,2 +1,6 @@
 import { AuthenticateUserResponse } from 'quidproquo-core';
+/**
+ * Confirms a forgot-password reset with the emailed code and new password, then
+ * signs the user straight in with it.
+ */
 export declare const confirmForgotPassword: (userPoolId: string, clientId: string, region: string, code: string, username: string, password: string) => Promise<AuthenticateUserResponse>;

package/lib/esm/logic/cognito/confirmForgotPassword.js

@@ -3,6 +3,10 @@ import { createAwsClient } from '../createAwsClient';
 import { calculateSecretHash } from './utils/calculateSecretHash';
 import { authenticateUser } from './authenticateUser';
 import { getUserPoolClientSecret } from './getUserPoolClientSecret';
+/**
+ * Confirms a forgot-password reset with the emailed code and new password, then
+ * signs the user straight in with it.
+ */
 export const confirmForgotPassword = async (userPoolId, clientId, region, code, username, password) => {
     const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {
         region,
@@ -17,8 +21,6 @@ export const confirmForgotPassword = async (userPoolId, clientId, region, code,
         Username: username,
     };
     await cognitoClient.send(new ConfirmForgotPasswordCommand(params));
-    // Authenticate the user
-    const authResponse = await authenticateUser(userPoolId, clientId, region, false, username, password);
-    return authResponse;
+    return authenticateUser(userPoolId, clientId, region, false, username, password);
 };
 //# sourceMappingURL=confirmForgotPassword.js.map

package/lib/esm/logic/cognito/confirmForgotPassword.js.map

@@ -1 +1 @@
-{"version":3,"file":"confirmForgotPassword.js","sourceRoot":"","sources":["../../../../src/logic/cognito/confirmForgotPassword.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,GAE7B,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACxC,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,IAAY,EACZ,QAAgB,EAChB,QAAgB,EACmB,EAAE;IACrC,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAsC;QAChD,QAAQ,EAAE,QAAQ;QAElB,gBAAgB,EAAE,IAAI;QACtB,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,QAAQ;KACnB,CAAC;IAEF,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,4BAA4B,CAAC,MAAM,CAAC,CAAC,CAAC;IAEnE,wBAAwB;IACxB,MAAM,YAAY,GAA6B,MAAM,gBAAgB,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAE/H,OAAO,YAAY,CAAC;AACtB,CAAC,CAAC","sourcesContent":["import { AuthenticateUserResponse } from 'quidproquo-core';\n\nimport {\n  CognitoIdentityProviderClient,\n  ConfirmForgotPasswordCommand,\n  ConfirmForgotPasswordCommandInput,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { authenticateUser } from './authenticateUser';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\nexport const confirmForgotPassword = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  code: string,\n  username: string,\n  password: string,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  const params: ConfirmForgotPasswordCommandInput = {\n    ClientId: clientId,\n\n    ConfirmationCode: code,\n    SecretHash: secretHash,\n    Password: password,\n    Username: username,\n  };\n\n  await cognitoClient.send(new ConfirmForgotPasswordCommand(params));\n\n  // Authenticate the user\n  const authResponse: AuthenticateUserResponse = await authenticateUser(userPoolId, clientId, region, false, username, password);\n\n  return authResponse;\n};\n"]}
+{"version":3,"file":"confirmForgotPassword.js","sourceRoot":"","sources":["../../../../src/logic/cognito/confirmForgotPassword.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,GAE7B,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEpE;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACxC,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,IAAY,EACZ,QAAgB,EAChB,QAAgB,EACmB,EAAE;IACrC,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAsC;QAChD,QAAQ,EAAE,QAAQ;QAElB,gBAAgB,EAAE,IAAI;QACtB,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,QAAQ;KACnB,CAAC;IAEF,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,4BAA4B,CAAC,MAAM,CAAC,CAAC,CAAC;IAEnE,OAAO,gBAAgB,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACnF,CAAC,CAAC","sourcesContent":["import { AuthenticateUserResponse } from 'quidproquo-core';\n\nimport {\n  CognitoIdentityProviderClient,\n  ConfirmForgotPasswordCommand,\n  ConfirmForgotPasswordCommandInput,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { authenticateUser } from './authenticateUser';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\n/**\n * Confirms a forgot-password reset with the emailed code and new password, then\n * signs the user straight in with it.\n */\nexport const confirmForgotPassword = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  code: string,\n  username: string,\n  password: string,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  const params: ConfirmForgotPasswordCommandInput = {\n    ClientId: clientId,\n\n    ConfirmationCode: code,\n    SecretHash: secretHash,\n    Password: password,\n    Username: username,\n  };\n\n  await cognitoClient.send(new ConfirmForgotPasswordCommand(params));\n\n  return authenticateUser(userPoolId, clientId, region, false, username, password);\n};\n"]}

package/lib/esm/logic/cognito/createUser.d.ts

@@ -1,2 +1,6 @@
 import { AuthenticateUserResponse, CreateUserRequest } from 'quidproquo-core';
+/**
+ * Creates a Cognito user with the requested attributes, activates their password
+ * and signs them in, returning the authenticated session.
+ */
 export declare const createUser: (userPoolId: string, region: string, clientId: string, createUserRequest: CreateUserRequest) => Promise<AuthenticateUserResponse>;

package/lib/esm/logic/cognito/createUser.js

@@ -1,8 +1,12 @@
 import { AdminCreateUserCommand, CognitoIdentityProviderClient, DeliveryMediumType, MessageActionType, } from '@aws-sdk/client-cognito-identity-provider';
 import { createAwsClient } from '../createAwsClient';
 import { authenticateUser } from './authenticateUser';
-import { getCognitoUserAttributesFromQpqUserAttributes } from './cognitoAttributeMap';
+import { getCognitoUserAttributesFromQpqUserAttributes } from './getCognitoUserAttributesFromQpqUserAttributes';
 import { setUserPassword } from './setUserPassword';
+/**
+ * Creates a Cognito user with the requested attributes, activates their password
+ * and signs them in, returning the authenticated session.
+ */
 export const createUser = async (userPoolId, region, clientId, createUserRequest) => {
     const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {
         region,
@@ -12,6 +16,8 @@ export const createUser = async (userPoolId, region, clientId, createUserRequest
         Username: createUserRequest.email,
         MessageAction: MessageActionType.SUPPRESS, // Don't contact the user
         DesiredDeliveryMediums: [DeliveryMediumType.EMAIL],
+        // createUserRequest includes password; it has no cognitoAttributeMap entry,
+        // so the mapper drops it rather than writing it as a user attribute.
         UserAttributes: getCognitoUserAttributesFromQpqUserAttributes(createUserRequest),
         ForceAliasCreation: false,
     };
@@ -20,10 +26,7 @@ export const createUser = async (userPoolId, region, clientId, createUserRequest
     }
     const response = await cognitoClient.send(new AdminCreateUserCommand(params));
     const username = response.User?.Username || '';
-    // Set the user's password
     await setUserPassword(region, userPoolId, username, createUserRequest.password);
-    // Authenticate the user
-    const authResponse = await authenticateUser(userPoolId, clientId, region, false, username, createUserRequest.password);
-    return authResponse;
+    return authenticateUser(userPoolId, clientId, region, false, username, createUserRequest.password);
 };
 //# sourceMappingURL=createUser.js.map

package/lib/esm/logic/cognito/createUser.js.map

@@ -1 +1 @@
-{"version":3,"file":"createUser.js","sourceRoot":"","sources":["../../../../src/logic/cognito/createUser.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,sBAAsB,EAEtB,6BAA6B,EAC7B,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,6CAA6C,EAAE,MAAM,uBAAuB,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAC7B,UAAkB,EAClB,MAAc,EACd,QAAgB,EAChB,iBAAoC,EACD,EAAE;IACrC,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAAgC;QAC1C,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,iBAAiB,CAAC,KAAK;QACjC,aAAa,EAAE,iBAAiB,CAAC,QAAQ,EAAE,yBAAyB;QACpE,sBAAsB,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC;QAClD,cAAc,EAAE,6CAA6C,CAAC,iBAAiB,CAAC;QAChF,kBAAkB,EAAE,KAAK;KAC1B,CAAC;IAEF,IAAI,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,CAAC,sBAAuB,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;IAE9E,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;IAE/C,0BAA0B;IAC1B,MAAM,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAEhF,wBAAwB;IACxB,MAAM,YAAY,GAA6B,MAAM,gBAAgB,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAEjJ,OAAO,YAAY,CAAC;AACtB,CAAC,CAAC","sourcesContent":["import { AuthenticateUserResponse, CreateUserRequest } from 'quidproquo-core';\n\nimport {\n  AdminCreateUserCommand,\n  AdminCreateUserCommandInput,\n  CognitoIdentityProviderClient,\n  DeliveryMediumType,\n  MessageActionType,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { authenticateUser } from './authenticateUser';\nimport { getCognitoUserAttributesFromQpqUserAttributes } from './cognitoAttributeMap';\nimport { setUserPassword } from './setUserPassword';\n\nexport const createUser = async (\n  userPoolId: string,\n  region: string,\n  clientId: string,\n  createUserRequest: CreateUserRequest,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params: AdminCreateUserCommandInput = {\n    UserPoolId: userPoolId,\n    Username: createUserRequest.email,\n    MessageAction: MessageActionType.SUPPRESS, // Don't contact the user\n    DesiredDeliveryMediums: [DeliveryMediumType.EMAIL],\n    UserAttributes: getCognitoUserAttributesFromQpqUserAttributes(createUserRequest),\n    ForceAliasCreation: false,\n  };\n\n  if (createUserRequest.phoneNumber) {\n    params.DesiredDeliveryMediums!.push(DeliveryMediumType.SMS);\n  }\n\n  const response = await cognitoClient.send(new AdminCreateUserCommand(params));\n\n  const username = response.User?.Username || '';\n\n  // Set the user's password\n  await setUserPassword(region, userPoolId, username, createUserRequest.password);\n\n  // Authenticate the user\n  const authResponse: AuthenticateUserResponse = await authenticateUser(userPoolId, clientId, region, false, username, createUserRequest.password);\n\n  return authResponse;\n};\n"]}
+{"version":3,"file":"createUser.js","sourceRoot":"","sources":["../../../../src/logic/cognito/createUser.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,sBAAsB,EAEtB,6BAA6B,EAC7B,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,6CAA6C,EAAE,MAAM,iDAAiD,CAAC;AAChH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAC7B,UAAkB,EAClB,MAAc,EACd,QAAgB,EAChB,iBAAoC,EACD,EAAE;IACrC,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAAgC;QAC1C,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,iBAAiB,CAAC,KAAK;QACjC,aAAa,EAAE,iBAAiB,CAAC,QAAQ,EAAE,yBAAyB;QACpE,sBAAsB,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC;QAClD,4EAA4E;QAC5E,qEAAqE;QACrE,cAAc,EAAE,6CAA6C,CAAC,iBAAiB,CAAC;QAChF,kBAAkB,EAAE,KAAK;KAC1B,CAAC;IAEF,IAAI,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,CAAC,sBAAuB,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;IAE9E,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;IAE/C,MAAM,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAEhF,OAAO,gBAAgB,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AACrG,CAAC,CAAC","sourcesContent":["import { AuthenticateUserResponse, CreateUserRequest } from 'quidproquo-core';\n\nimport {\n  AdminCreateUserCommand,\n  AdminCreateUserCommandInput,\n  CognitoIdentityProviderClient,\n  DeliveryMediumType,\n  MessageActionType,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { authenticateUser } from './authenticateUser';\nimport { getCognitoUserAttributesFromQpqUserAttributes } from './getCognitoUserAttributesFromQpqUserAttributes';\nimport { setUserPassword } from './setUserPassword';\n\n/**\n * Creates a Cognito user with the requested attributes, activates their password\n * and signs them in, returning the authenticated session.\n */\nexport const createUser = async (\n  userPoolId: string,\n  region: string,\n  clientId: string,\n  createUserRequest: CreateUserRequest,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params: AdminCreateUserCommandInput = {\n    UserPoolId: userPoolId,\n    Username: createUserRequest.email,\n    MessageAction: MessageActionType.SUPPRESS, // Don't contact the user\n    DesiredDeliveryMediums: [DeliveryMediumType.EMAIL],\n    // createUserRequest includes password; it has no cognitoAttributeMap entry,\n    // so the mapper drops it rather than writing it as a user attribute.\n    UserAttributes: getCognitoUserAttributesFromQpqUserAttributes(createUserRequest),\n    ForceAliasCreation: false,\n  };\n\n  if (createUserRequest.phoneNumber) {\n    params.DesiredDeliveryMediums!.push(DeliveryMediumType.SMS);\n  }\n\n  const response = await cognitoClient.send(new AdminCreateUserCommand(params));\n\n  const username = response.User?.Username || '';\n\n  await setUserPassword(region, userPoolId, username, createUserRequest.password);\n\n  return authenticateUser(userPoolId, clientId, region, false, username, createUserRequest.password);\n};\n"]}

package/lib/esm/logic/cognito/decodeAccessToken.d.ts

@@ -1,2 +1,13 @@
 import { DecodedAccessToken, QPQConfig } from 'quidproquo-core';
+export declare class InvalidAccessTokenError extends Error {
+    readonly code = "INVALID_ACCESS_TOKEN";
+    constructor();
+}
+/**
+ * Decodes and verifies a Cognito access token for the given user directory,
+ * resolving the pool id from the directory's CloudFormation export. Throws
+ * InvalidAccessTokenError when the token is missing or fails verification.
+ * With ignoreExpiration, an expired but otherwise valid token is returned with
+ * wasValid false.
+ */
 export declare const decodeAccessToken: (userDirectoryName: string, qpqConfig: QPQConfig, accessToken?: string, ignoreExpiration?: boolean) => Promise<DecodedAccessToken>;

package/lib/esm/logic/cognito/decodeAccessToken.js

@@ -2,19 +2,37 @@ import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
 import { getCFExportNameUserPoolIdFromConfig } from '../../awsNamingUtils';
 import { getExportedValue } from '../cloudformation/getExportedValue';
 import { decodeValidJwt } from './decodeValidJwt';
+// decodeValidJwt returns null rather than throwing, so this throw is the
+// discriminable signal callers (e.g. the SetAccessToken processor) catch to
+// produce an Unauthorized result.
+export class InvalidAccessTokenError extends Error {
+    code = 'INVALID_ACCESS_TOKEN';
+    constructor() {
+        super('Unable to decode access token');
+        this.name = 'InvalidAccessTokenError';
+    }
+}
+/**
+ * Decodes and verifies a Cognito access token for the given user directory,
+ * resolving the pool id from the directory's CloudFormation export. Throws
+ * InvalidAccessTokenError when the token is missing or fails verification.
+ * With ignoreExpiration, an expired but otherwise valid token is returned with
+ * wasValid false.
+ */
 export const decodeAccessToken = async (userDirectoryName, qpqConfig, accessToken, ignoreExpiration = false) => {
     const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
     const userPoolId = await getExportedValue(getCFExportNameUserPoolIdFromConfig(userDirectoryName, qpqConfig), region);
     const decodedAuthToken = await decodeValidJwt(userPoolId, region, ignoreExpiration, accessToken);
-    if (!decodedAuthToken || !decodedAuthToken?.username) {
-        throw new Error('Unable to decode access token');
+    if (!decodedAuthToken?.username) {
+        throw new InvalidAccessTokenError();
     }
+    // decodeValidJwt only enforces expiry when ignoreExpiration is false, so
+    // recheck here to report whether an ignored-expiry token was actually valid.
     const wasValid = !ignoreExpiration || decodedAuthToken.exp > Math.floor(Date.now() / 1000);
-    const decodedAccesToken = {
+    return {
         ...decodedAuthToken,
         wasValid,
         userDirectory: userDirectoryName,
     };
-    return decodedAccesToken;
 };
 //# sourceMappingURL=decodeAccessToken.js.map

package/lib/esm/logic/cognito/decodeAccessToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"decodeAccessToken.js","sourceRoot":"","sources":["../../../../src/logic/cognito/decodeAccessToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAG1D,OAAO,EAAE,mCAAmC,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EACpC,iBAAyB,EACzB,SAAoB,EACpB,WAAoB,EACpB,mBAA4B,KAAK,EACJ,EAAE;IAC/B,MAAM,MAAM,GAAG,iBAAiB,CAAC,gCAAgC,CAAC,SAAS,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,mCAAmC,CAAC,iBAAiB,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;IAErH,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;IAEjG,IAAI,CAAC,gBAAgB,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,gBAAgB,IAAI,gBAAgB,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE3F,MAAM,iBAAiB,GAAuB;QAC5C,GAAG,gBAAgB;QAEnB,QAAQ;QACR,aAAa,EAAE,iBAAiB;KACjC,CAAC;IAEF,OAAO,iBAAiB,CAAC;AAC3B,CAAC,CAAC","sourcesContent":["import { qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport { DecodedAccessToken, QPQConfig, qpqCoreUtils } from 'quidproquo-core';\n\nimport { getCFExportNameUserPoolIdFromConfig } from '../../awsNamingUtils';\nimport { getExportedValue } from '../cloudformation/getExportedValue';\nimport { decodeValidJwt } from './decodeValidJwt';\n\nexport const decodeAccessToken = async (\n  userDirectoryName: string,\n  qpqConfig: QPQConfig,\n  accessToken?: string,\n  ignoreExpiration: boolean = false,\n): Promise<DecodedAccessToken> => {\n  const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);\n  const userPoolId = await getExportedValue(getCFExportNameUserPoolIdFromConfig(userDirectoryName, qpqConfig), region);\n\n  const decodedAuthToken = await decodeValidJwt(userPoolId, region, ignoreExpiration, accessToken);\n\n  if (!decodedAuthToken || !decodedAuthToken?.username) {\n    throw new Error('Unable to decode access token');\n  }\n\n  const wasValid = !ignoreExpiration || decodedAuthToken.exp > Math.floor(Date.now() / 1000);\n\n  const decodedAccesToken: DecodedAccessToken = {\n    ...decodedAuthToken,\n\n    wasValid,\n    userDirectory: userDirectoryName,\n  };\n\n  return decodedAccesToken;\n};\n"]}
+{"version":3,"file":"decodeAccessToken.js","sourceRoot":"","sources":["../../../../src/logic/cognito/decodeAccessToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAG1D,OAAO,EAAE,mCAAmC,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,yEAAyE;AACzE,4EAA4E;AAC5E,kCAAkC;AAClC,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,IAAI,GAAG,sBAAsB,CAAC;IAEvC;QACE,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EACpC,iBAAyB,EACzB,SAAoB,EACpB,WAAoB,EACpB,mBAA4B,KAAK,EACJ,EAAE;IAC/B,MAAM,MAAM,GAAG,iBAAiB,CAAC,gCAAgC,CAAC,SAAS,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,mCAAmC,CAAC,iBAAiB,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;IAErH,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;IAEjG,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,uBAAuB,EAAE,CAAC;IACtC,CAAC;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,CAAC,gBAAgB,IAAI,gBAAgB,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE3F,OAAO;QACL,GAAG,gBAAgB;QAEnB,QAAQ;QACR,aAAa,EAAE,iBAAiB;KACjC,CAAC;AACJ,CAAC,CAAC","sourcesContent":["import { qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport { DecodedAccessToken, QPQConfig } from 'quidproquo-core';\n\nimport { getCFExportNameUserPoolIdFromConfig } from '../../awsNamingUtils';\nimport { getExportedValue } from '../cloudformation/getExportedValue';\nimport { decodeValidJwt } from './decodeValidJwt';\n\n// decodeValidJwt returns null rather than throwing, so this throw is the\n// discriminable signal callers (e.g. the SetAccessToken processor) catch to\n// produce an Unauthorized result.\nexport class InvalidAccessTokenError extends Error {\n  readonly code = 'INVALID_ACCESS_TOKEN';\n\n  constructor() {\n    super('Unable to decode access token');\n    this.name = 'InvalidAccessTokenError';\n  }\n}\n\n/**\n * Decodes and verifies a Cognito access token for the given user directory,\n * resolving the pool id from the directory's CloudFormation export. Throws\n * InvalidAccessTokenError when the token is missing or fails verification.\n * With ignoreExpiration, an expired but otherwise valid token is returned with\n * wasValid false.\n */\nexport const decodeAccessToken = async (\n  userDirectoryName: string,\n  qpqConfig: QPQConfig,\n  accessToken?: string,\n  ignoreExpiration: boolean = false,\n): Promise<DecodedAccessToken> => {\n  const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);\n  const userPoolId = await getExportedValue(getCFExportNameUserPoolIdFromConfig(userDirectoryName, qpqConfig), region);\n\n  const decodedAuthToken = await decodeValidJwt(userPoolId, region, ignoreExpiration, accessToken);\n\n  if (!decodedAuthToken?.username) {\n    throw new InvalidAccessTokenError();\n  }\n\n  // decodeValidJwt only enforces expiry when ignoreExpiration is false, so\n  // recheck here to report whether an ignored-expiry token was actually valid.\n  const wasValid = !ignoreExpiration || decodedAuthToken.exp > Math.floor(Date.now() / 1000);\n\n  return {\n    ...decodedAuthToken,\n\n    wasValid,\n    userDirectory: userDirectoryName,\n  };\n};\n"]}

package/lib/esm/logic/cognito/decodeValidJwt.d.ts

@@ -1,2 +1,8 @@
-import { DecodedAccessToken } from 'quidproquo-core';
-export declare const decodeValidJwt: (userPoolId: string, region: string, ignoreExpiration: boolean, accessToken?: string) => Promise<Omit<DecodedAccessToken, "userDirectory"> | null>;
+import { DecodedAccessToken, Nullable } from 'quidproquo-core';
+/**
+ * Verifies a Cognito access token and returns its decoded qpq shape: signature is
+ * checked against the pool's JWKS (RS256 only), plus issuer, expiry (unless
+ * ignoreExpiration) and token_use. Returns null for anything that fails; failures
+ * are logged in summary form only, never the token itself.
+ */
+export declare const decodeValidJwt: (userPoolId: string, region: string, ignoreExpiration: boolean, accessToken?: string) => Promise<Nullable<Omit<DecodedAccessToken, "userDirectory">>>;

package/lib/esm/logic/cognito/decodeValidJwt.js

@@ -1,5 +1,11 @@
 import { decode, verify } from 'jsonwebtoken';
-import jwksClient from 'jwks-rsa';
+import { getCognitoJwksClient } from './getCognitoJwksClient';
+/**
+ * Verifies a Cognito access token and returns its decoded qpq shape: signature is
+ * checked against the pool's JWKS (RS256 only), plus issuer, expiry (unless
+ * ignoreExpiration) and token_use. Returns null for anything that fails; failures
+ * are logged in summary form only, never the token itself.
+ */
 export const decodeValidJwt = async (userPoolId, region, ignoreExpiration, accessToken) => {
     if (!accessToken) {
         return null;
@@ -9,22 +15,25 @@ export const decodeValidJwt = async (userPoolId, region, ignoreExpiration, acces
         if (!decodedToken) {
             return null;
         }
-        const client = jwksClient({
-            jwksUri: `https://cognito-idp.${region}.amazonaws.com/${userPoolId}/.well-known/jwks.json`,
-        });
+        const client = getCognitoJwksClient(`https://cognito-idp.${region}.amazonaws.com/${userPoolId}/.well-known/jwks.json`);
         const key = await client.getSigningKey(decodedToken.header.kid);
         const signingKey = key.getPublicKey();
         const payload = verify(accessToken, signingKey, {
             algorithms: ['RS256'],
+            issuer: `https://cognito-idp.${region}.amazonaws.com/${userPoolId}`,
             ignoreExpiration,
         });
-        const decodedAccessToken = {
+        // An id token from the same pool passes signature verification too; only
+        // access tokens are acceptable here.
+        if (payload.token_use !== 'access') {
+            return null;
+        }
+        return {
             userId: payload.sub,
             username: payload.username,
             exp: payload.exp,
             wasValid: true,
         };
-        return decodedAccessToken;
     }
     catch (e) {
         const summary = e instanceof Error ? `${e.name}: ${e.message}` : 'unknown error';

package/lib/esm/logic/cognito/decodeValidJwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"decodeValidJwt.js","sourceRoot":"","sources":["../../../../src/logic/cognito/decodeValidJwt.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,UAAU,MAAM,UAAU,CAAC;AAkBlC,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,UAAkB,EAClB,MAAc,EACd,gBAAyB,EACzB,WAAoB,EACuC,EAAE;IAC7D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC;YACxB,OAAO,EAAE,uBAAuB,MAAM,kBAAkB,UAAU,wBAAwB;SAC3F,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;QAEtC,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,EAAE,UAAU,EAAE;YAC9C,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,gBAAgB;SACjB,CAAe,CAAC;QAEjB,MAAM,kBAAkB,GAA8C;YACpE,MAAM,EAAE,OAAO,CAAC,GAAG;YACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,QAAQ,EAAE,IAAI;SACf,CAAC;QAEF,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,OAAO,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC","sourcesContent":["import { DecodedAccessToken } from 'quidproquo-core';\n\nimport { decode, verify } from 'jsonwebtoken';\nimport jwksClient from 'jwks-rsa';\n\n// TODO: Check whey we need this? I think you should be able to get types from the lib?\ntype JwtPayload = {\n  sub: string;\n  iss: string;\n  client_id: string;\n  origin_jti: string;\n  event_id: string;\n  token_use: string;\n  scope: string;\n  auth_time: number;\n  exp: number;\n  iat: number;\n  jti: string;\n  username: string;\n};\n\nexport const decodeValidJwt = async (\n  userPoolId: string,\n  region: string,\n  ignoreExpiration: boolean,\n  accessToken?: string,\n): Promise<Omit<DecodedAccessToken, 'userDirectory'> | null> => {\n  if (!accessToken) {\n    return null;\n  }\n\n  try {\n    const decodedToken = decode(accessToken, { complete: true });\n    if (!decodedToken) {\n      return null;\n    }\n\n    const client = jwksClient({\n      jwksUri: `https://cognito-idp.${region}.amazonaws.com/${userPoolId}/.well-known/jwks.json`,\n    });\n\n    const key = await client.getSigningKey(decodedToken.header.kid);\n    const signingKey = key.getPublicKey();\n\n    const payload = verify(accessToken, signingKey, {\n      algorithms: ['RS256'],\n      ignoreExpiration,\n    }) as JwtPayload;\n\n    const decodedAccessToken: Omit<DecodedAccessToken, 'userDirectory'> = {\n      userId: payload.sub,\n      username: payload.username,\n      exp: payload.exp,\n      wasValid: true,\n    };\n\n    return decodedAccessToken;\n  } catch (e) {\n    const summary = e instanceof Error ? `${e.name}: ${e.message}` : 'unknown error';\n    console.log('Failed to decode jwt token:', summary);\n    return null;\n  }\n};\n"]}
+{"version":3,"file":"decodeValidJwt.js","sourceRoot":"","sources":["../../../../src/logic/cognito/decodeValidJwt.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAW9D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,UAAkB,EAClB,MAAc,EACd,gBAAyB,EACzB,WAAoB,EAC0C,EAAE;IAChE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,uBAAuB,MAAM,kBAAkB,UAAU,wBAAwB,CAAC,CAAC;QAEvH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;QAEtC,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,EAAE,UAAU,EAAE;YAC9C,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,uBAAuB,MAAM,kBAAkB,UAAU,EAAE;YACnE,gBAAgB;SACjB,CAA8B,CAAC;QAEhC,yEAAyE;QACzE,qCAAqC;QACrC,IAAI,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,GAAG;YACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,QAAQ,EAAE,IAAI;SACf,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,OAAO,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC","sourcesContent":["import { DecodedAccessToken, Nullable } from 'quidproquo-core';\n\nimport { decode, verify } from 'jsonwebtoken';\n\nimport { getCognitoJwksClient } from './getCognitoJwksClient';\n\n// The jsonwebtoken lib types every claim as optional, so the Cognito\n// access-token claims this decoder relies on are typed here.\ntype CognitoAccessTokenPayload = {\n  sub: string;\n  token_use: string;\n  username: string;\n  exp: number;\n};\n\n/**\n * Verifies a Cognito access token and returns its decoded qpq shape: signature is\n * checked against the pool's JWKS (RS256 only), plus issuer, expiry (unless\n * ignoreExpiration) and token_use. Returns null for anything that fails; failures\n * are logged in summary form only, never the token itself.\n */\nexport const decodeValidJwt = async (\n  userPoolId: string,\n  region: string,\n  ignoreExpiration: boolean,\n  accessToken?: string,\n): Promise<Nullable<Omit<DecodedAccessToken, 'userDirectory'>>> => {\n  if (!accessToken) {\n    return null;\n  }\n\n  try {\n    const decodedToken = decode(accessToken, { complete: true });\n    if (!decodedToken) {\n      return null;\n    }\n\n    const client = getCognitoJwksClient(`https://cognito-idp.${region}.amazonaws.com/${userPoolId}/.well-known/jwks.json`);\n\n    const key = await client.getSigningKey(decodedToken.header.kid);\n    const signingKey = key.getPublicKey();\n\n    const payload = verify(accessToken, signingKey, {\n      algorithms: ['RS256'],\n      issuer: `https://cognito-idp.${region}.amazonaws.com/${userPoolId}`,\n      ignoreExpiration,\n    }) as CognitoAccessTokenPayload;\n\n    // An id token from the same pool passes signature verification too; only\n    // access tokens are acceptable here.\n    if (payload.token_use !== 'access') {\n      return null;\n    }\n\n    return {\n      userId: payload.sub,\n      username: payload.username,\n      exp: payload.exp,\n      wasValid: true,\n    };\n  } catch (e) {\n    const summary = e instanceof Error ? `${e.name}: ${e.message}` : 'unknown error';\n    console.log('Failed to decode jwt token:', summary);\n    return null;\n  }\n};\n"]}

package/lib/esm/logic/cognito/forgotPassword.js

@@ -1,6 +1,7 @@
 import { CognitoIdentityProviderClient, ForgotPasswordCommand } from '@aws-sdk/client-cognito-identity-provider';
 import { createAwsClient } from '../createAwsClient';
 import { calculateSecretHash } from './utils/calculateSecretHash';
+import { cognitoCodeDeliveryDetailsToQpqDeliveryDetails } from './utils/cognitoCodeDeliveryDetailsToQpqDeliveryDetails';
 import { getUserPoolClientSecret } from './getUserPoolClientSecret';
 export const forgotPassword = async (userPoolId, clientId, region, username) => {
     const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {
@@ -17,11 +18,6 @@ export const forgotPassword = async (userPoolId, clientId, region, username) =>
         },
     };
     const response = await cognitoClient.send(new ForgotPasswordCommand(params));
-    const deliveryInfo = {
-        attributeName: response.CodeDeliveryDetails.AttributeName || 'email',
-        destination: response.CodeDeliveryDetails.Destination || 'unknown@email.com',
-        deliveryMedium: response.CodeDeliveryDetails.DeliveryMedium || 'EMAIL',
-    };
-    return deliveryInfo;
+    return cognitoCodeDeliveryDetailsToQpqDeliveryDetails(response.CodeDeliveryDetails);
 };
 //# sourceMappingURL=forgotPassword.js.map

package/lib/esm/logic/cognito/forgotPassword.js.map

@@ -1 +1 @@
-{"version":3,"file":"forgotPassword.js","sourceRoot":"","sources":["../../../../src/logic/cognito/forgotPassword.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,6BAA6B,EAAE,qBAAqB,EAA8B,MAAM,2CAA2C,CAAC;AAE7I,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,QAAgB,EACwB,EAAE;IAC1C,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAA+B;QACzC,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,UAAU;QACtB,cAAc,EAAE;YACd,aAAa,EAAE,MAAM;SACtB;KACF,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IAE7E,MAAM,YAAY,GAAG;QACnB,aAAa,EAAE,QAAQ,CAAC,mBAAoB,CAAC,aAAa,IAAI,OAAO;QACrE,WAAW,EAAE,QAAQ,CAAC,mBAAoB,CAAC,WAAW,IAAI,mBAAmB;QAC7E,cAAc,EAAE,QAAQ,CAAC,mBAAoB,CAAC,cAAc,IAAI,OAAO;KACvC,CAAC;IAEnC,OAAO,YAAY,CAAC;AACtB,CAAC,CAAC","sourcesContent":["import { AuthenticationDeliveryDetails } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ForgotPasswordCommand, ForgotPasswordCommandInput } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\nexport const forgotPassword = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  username: string,\n): Promise<AuthenticationDeliveryDetails> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  const params: ForgotPasswordCommandInput = {\n    ClientId: clientId,\n    Username: username,\n    SecretHash: secretHash,\n    ClientMetadata: {\n      userInitiated: 'true',\n    },\n  };\n\n  const response = await cognitoClient.send(new ForgotPasswordCommand(params));\n\n  const deliveryInfo = {\n    attributeName: response.CodeDeliveryDetails!.AttributeName || 'email',\n    destination: response.CodeDeliveryDetails!.Destination || 'unknown@email.com',\n    deliveryMedium: response.CodeDeliveryDetails!.DeliveryMedium || 'EMAIL',\n  } as AuthenticationDeliveryDetails;\n\n  return deliveryInfo;\n};\n"]}
+{"version":3,"file":"forgotPassword.js","sourceRoot":"","sources":["../../../../src/logic/cognito/forgotPassword.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,6BAA6B,EAAE,qBAAqB,EAA8B,MAAM,2CAA2C,CAAC;AAE7I,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,8CAA8C,EAAE,MAAM,wDAAwD,CAAC;AACxH,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,QAAgB,EACwB,EAAE;IAC1C,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAA+B;QACzC,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,UAAU;QACtB,cAAc,EAAE;YACd,aAAa,EAAE,MAAM;SACtB;KACF,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IAE7E,OAAO,8CAA8C,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;AACtF,CAAC,CAAC","sourcesContent":["import { AuthenticationDeliveryDetails } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ForgotPasswordCommand, ForgotPasswordCommandInput } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { cognitoCodeDeliveryDetailsToQpqDeliveryDetails } from './utils/cognitoCodeDeliveryDetailsToQpqDeliveryDetails';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\nexport const forgotPassword = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  username: string,\n): Promise<AuthenticationDeliveryDetails> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  const params: ForgotPasswordCommandInput = {\n    ClientId: clientId,\n    Username: username,\n    SecretHash: secretHash,\n    ClientMetadata: {\n      userInitiated: 'true',\n    },\n  };\n\n  const response = await cognitoClient.send(new ForgotPasswordCommand(params));\n\n  return cognitoCodeDeliveryDetailsToQpqDeliveryDetails(response.CodeDeliveryDetails);\n};\n"]}

package/lib/esm/logic/cognito/getCognitoJwksClient.d.ts

@@ -0,0 +1,7 @@
+import { JwksClient } from 'jwks-rsa';
+/**
+ * Returns the JWKS client for a Cognito jwks.json uri. Memoized because jwks-rsa
+ * caches fetched signing keys per client instance; a fresh client per verification
+ * would refetch the pool's JWKS over HTTP on every call.
+ */
+export declare const getCognitoJwksClient: (jwksUri: string) => JwksClient;

package/lib/esm/logic/cognito/getCognitoJwksClient.js

@@ -0,0 +1,9 @@
+import jwksClient from 'jwks-rsa';
+import { memoFunc } from '../cache/memoFunc';
+/**
+ * Returns the JWKS client for a Cognito jwks.json uri. Memoized because jwks-rsa
+ * caches fetched signing keys per client instance; a fresh client per verification
+ * would refetch the pool's JWKS over HTTP on every call.
+ */
+export const getCognitoJwksClient = memoFunc((jwksUri) => jwksClient({ jwksUri }));
+//# sourceMappingURL=getCognitoJwksClient.js.map

package/lib/esm/logic/cognito/getCognitoJwksClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getCognitoJwksClient.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getCognitoJwksClient.ts"],"names":[],"mappings":"AAAA,OAAO,UAA0B,MAAM,UAAU,CAAC;AAElD,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC,CAAC,OAAe,EAAc,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC","sourcesContent":["import jwksClient, { JwksClient } from 'jwks-rsa';\n\nimport { memoFunc } from '../cache/memoFunc';\n\n/**\n * Returns the JWKS client for a Cognito jwks.json uri. Memoized because jwks-rsa\n * caches fetched signing keys per client instance; a fresh client per verification\n * would refetch the pool's JWKS over HTTP on every call.\n */\nexport const getCognitoJwksClient = memoFunc((jwksUri: string): JwksClient => jwksClient({ jwksUri }));\n"]}

package/lib/esm/logic/cognito/getCognitoUserAttributesFromQpqUserAttributes.d.ts

@@ -0,0 +1,8 @@
+import { UserAttributes } from 'quidproquo-core';
+import { CognitoUserAttribute } from './utils/CognitoUserAttribute';
+/**
+ * Maps qpq UserAttributes onto Cognito Name/Value pairs. Keys with no Cognito
+ * mapping (e.g. password on CreateUserRequest) and absent or empty values are
+ * dropped; everything else is stringified (booleans become 'true'/'false').
+ */
+export declare const getCognitoUserAttributesFromQpqUserAttributes: (userAttributes: UserAttributes) => CognitoUserAttribute[];

package/lib/esm/logic/cognito/getCognitoUserAttributesFromQpqUserAttributes.js

@@ -0,0 +1,16 @@
+import { cognitoAttributeMap } from './cognitoAttributeMap';
+/**
+ * Maps qpq UserAttributes onto Cognito Name/Value pairs. Keys with no Cognito
+ * mapping (e.g. password on CreateUserRequest) and absent or empty values are
+ * dropped; everything else is stringified (booleans become 'true'/'false').
+ */
+export const getCognitoUserAttributesFromQpqUserAttributes = (userAttributes) => {
+    return Object.keys(userAttributes)
+        .filter((key) => userAttributes[key] !== undefined && userAttributes[key] !== null)
+        .map((key) => ({
+        Name: cognitoAttributeMap[key],
+        Value: `${userAttributes[key]}`,
+    }))
+        .filter((attribute) => !!attribute.Name && !!attribute.Value);
+};
+//# sourceMappingURL=getCognitoUserAttributesFromQpqUserAttributes.js.map

package/lib/esm/logic/cognito/getCognitoUserAttributesFromQpqUserAttributes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getCognitoUserAttributesFromQpqUserAttributes.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getCognitoUserAttributesFromQpqUserAttributes.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D;;;;GAIG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,cAA8B,EAA0B,EAAE;IACtH,OAAQ,MAAM,CAAC,IAAI,CAAC,cAAc,CAA8B;SAC7D,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;SAClF,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACb,IAAI,EAAE,mBAAmB,CAAC,GAAG,CAAC;QAC9B,KAAK,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,EAAE;KAChC,CAAC,CAAC;SACF,MAAM,CAAC,CAAC,SAAS,EAAqC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACrG,CAAC,CAAC","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { CognitoUserAttribute } from './utils/CognitoUserAttribute';\nimport { cognitoAttributeMap } from './cognitoAttributeMap';\n\n/**\n * Maps qpq UserAttributes onto Cognito Name/Value pairs. Keys with no Cognito\n * mapping (e.g. password on CreateUserRequest) and absent or empty values are\n * dropped; everything else is stringified (booleans become 'true'/'false').\n */\nexport const getCognitoUserAttributesFromQpqUserAttributes = (userAttributes: UserAttributes): CognitoUserAttribute[] => {\n  return (Object.keys(userAttributes) as (keyof UserAttributes)[])\n    .filter((key) => userAttributes[key] !== undefined && userAttributes[key] !== null)\n    .map((key) => ({\n      Name: cognitoAttributeMap[key],\n      Value: `${userAttributes[key]}`,\n    }))\n    .filter((attribute): attribute is CognitoUserAttribute => !!attribute.Name && !!attribute.Value);\n};\n"]}

package/lib/esm/logic/cognito/getQpqAttributeObjectFromCognitoKeyValue.d.ts

@@ -0,0 +1,7 @@
+import { UserAttributes } from 'quidproquo-core';
+/**
+ * Maps a single Cognito attribute name/value onto a partial UserAttributes object.
+ * Names with no qpq mapping (e.g. cognito:groups) produce an empty object, and
+ * email_verified is coerced from Cognito's 'true'/'false' string to a boolean.
+ */
+export declare const getQpqAttributeObjectFromCognitoKeyValue: (key: string, value: string) => UserAttributes;

package/lib/esm/logic/cognito/getQpqAttributeObjectFromCognitoKeyValue.js

@@ -0,0 +1,18 @@
+import { cognitoAttributeMap } from './cognitoAttributeMap';
+const reversedCognitoAttributeMap = Object.fromEntries(Object.entries(cognitoAttributeMap).map(([qpqKey, cognitoName]) => [cognitoName, qpqKey]));
+/**
+ * Maps a single Cognito attribute name/value onto a partial UserAttributes object.
+ * Names with no qpq mapping (e.g. cognito:groups) produce an empty object, and
+ * email_verified is coerced from Cognito's 'true'/'false' string to a boolean.
+ */
+export const getQpqAttributeObjectFromCognitoKeyValue = (key, value) => {
+    const userAttributeKey = reversedCognitoAttributeMap[key];
+    if (!userAttributeKey) {
+        return {};
+    }
+    if (userAttributeKey === 'emailVerified') {
+        return { emailVerified: value === 'true' };
+    }
+    return { [userAttributeKey]: value };
+};
+//# sourceMappingURL=getQpqAttributeObjectFromCognitoKeyValue.js.map

package/lib/esm/logic/cognito/getQpqAttributeObjectFromCognitoKeyValue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getQpqAttributeObjectFromCognitoKeyValue.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getQpqAttributeObjectFromCognitoKeyValue.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,MAAM,2BAA2B,GAAyC,MAAM,CAAC,WAAW,CAC1F,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,MAA8B,CAAC,CAAC,CAClH,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,GAAW,EAAE,KAAa,EAAkB,EAAE;IACrG,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAE1D,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,gBAAgB,KAAK,eAAe,EAAE,CAAC;QACzC,OAAO,EAAE,aAAa,EAAE,KAAK,KAAK,MAAM,EAAE,CAAC;IAC7C,CAAC;IAED,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC;AACvC,CAAC,CAAC","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { cognitoAttributeMap } from './cognitoAttributeMap';\n\nconst reversedCognitoAttributeMap: Record<string, keyof UserAttributes> = Object.fromEntries(\n  Object.entries(cognitoAttributeMap).map(([qpqKey, cognitoName]) => [cognitoName, qpqKey as keyof UserAttributes]),\n);\n\n/**\n * Maps a single Cognito attribute name/value onto a partial UserAttributes object.\n * Names with no qpq mapping (e.g. cognito:groups) produce an empty object, and\n * email_verified is coerced from Cognito's 'true'/'false' string to a boolean.\n */\nexport const getQpqAttributeObjectFromCognitoKeyValue = (key: string, value: string): UserAttributes => {\n  const userAttributeKey = reversedCognitoAttributeMap[key];\n\n  if (!userAttributeKey) {\n    return {};\n  }\n\n  if (userAttributeKey === 'emailVerified') {\n    return { emailVerified: value === 'true' };\n  }\n\n  return { [userAttributeKey]: value };\n};\n"]}

package/lib/esm/logic/cognito/getQpqAttributesFromCognitoStringMap.d.ts

@@ -0,0 +1,6 @@
+import { UserAttributes } from 'quidproquo-core';
+/**
+ * Maps a Cognito name-to-value record (as delivered in lambda trigger events)
+ * onto the qpq UserAttributes shape.
+ */
+export declare const getQpqAttributesFromCognitoStringMap: (cognitoUserAttributes: Record<string, string>) => UserAttributes;

package/lib/esm/logic/cognito/getQpqAttributesFromCognitoStringMap.js

@@ -0,0 +1,13 @@
+import { getQpqAttributeObjectFromCognitoKeyValue } from './getQpqAttributeObjectFromCognitoKeyValue';
+/**
+ * Maps a Cognito name-to-value record (as delivered in lambda trigger events)
+ * onto the qpq UserAttributes shape.
+ */
+export const getQpqAttributesFromCognitoStringMap = (cognitoUserAttributes) => {
+    const userAttributes = {};
+    for (const [key, value] of Object.entries(cognitoUserAttributes)) {
+        Object.assign(userAttributes, getQpqAttributeObjectFromCognitoKeyValue(key, value));
+    }
+    return userAttributes;
+};
+//# sourceMappingURL=getQpqAttributesFromCognitoStringMap.js.map

package/lib/esm/logic/cognito/getQpqAttributesFromCognitoStringMap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getQpqAttributesFromCognitoStringMap.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getQpqAttributesFromCognitoStringMap.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,wCAAwC,EAAE,MAAM,4CAA4C,CAAC;AAEtG;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,qBAA6C,EAAkB,EAAE;IACpH,MAAM,cAAc,GAAmB,EAAE,CAAC;IAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACjE,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,wCAAwC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,OAAO,cAAc,CAAC;AACxB,CAAC,CAAC","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { getQpqAttributeObjectFromCognitoKeyValue } from './getQpqAttributeObjectFromCognitoKeyValue';\n\n/**\n * Maps a Cognito name-to-value record (as delivered in lambda trigger events)\n * onto the qpq UserAttributes shape.\n */\nexport const getQpqAttributesFromCognitoStringMap = (cognitoUserAttributes: Record<string, string>): UserAttributes => {\n  const userAttributes: UserAttributes = {};\n\n  for (const [key, value] of Object.entries(cognitoUserAttributes)) {\n    Object.assign(userAttributes, getQpqAttributeObjectFromCognitoKeyValue(key, value));\n  }\n\n  return userAttributes;\n};\n"]}

package/lib/esm/logic/cognito/getQpqAttributesFromCognitoUserAttributes.d.ts

@@ -0,0 +1,4 @@
+import { UserAttributes } from 'quidproquo-core';
+import { CognitoUserAttribute } from './utils/CognitoUserAttribute';
+/** Maps a list of Cognito user attributes onto the qpq UserAttributes shape. */
+export declare const getQpqAttributesFromCognitoUserAttributes: (cognitoUserAttributes: CognitoUserAttribute[]) => UserAttributes;

package/lib/esm/logic/cognito/getQpqAttributesFromCognitoUserAttributes.js

@@ -0,0 +1,10 @@
+import { getQpqAttributeObjectFromCognitoKeyValue } from './getQpqAttributeObjectFromCognitoKeyValue';
+/** Maps a list of Cognito user attributes onto the qpq UserAttributes shape. */
+export const getQpqAttributesFromCognitoUserAttributes = (cognitoUserAttributes) => {
+    const userAttributes = {};
+    for (const { Name, Value } of cognitoUserAttributes) {
+        Object.assign(userAttributes, getQpqAttributeObjectFromCognitoKeyValue(Name, Value));
+    }
+    return userAttributes;
+};
+//# sourceMappingURL=getQpqAttributesFromCognitoUserAttributes.js.map

package/lib/esm/logic/cognito/getQpqAttributesFromCognitoUserAttributes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getQpqAttributesFromCognitoUserAttributes.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getQpqAttributesFromCognitoUserAttributes.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,wCAAwC,EAAE,MAAM,4CAA4C,CAAC;AAEtG,gFAAgF;AAChF,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,qBAA6C,EAAkB,EAAE;IACzH,MAAM,cAAc,GAAmB,EAAE,CAAC;IAE1C,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,qBAAqB,EAAE,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,wCAAwC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACvF,CAAC;IAED,OAAO,cAAc,CAAC;AACxB,CAAC,CAAC","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { CognitoUserAttribute } from './utils/CognitoUserAttribute';\nimport { getQpqAttributeObjectFromCognitoKeyValue } from './getQpqAttributeObjectFromCognitoKeyValue';\n\n/** Maps a list of Cognito user attributes onto the qpq UserAttributes shape. */\nexport const getQpqAttributesFromCognitoUserAttributes = (cognitoUserAttributes: CognitoUserAttribute[]): UserAttributes => {\n  const userAttributes: UserAttributes = {};\n\n  for (const { Name, Value } of cognitoUserAttributes) {\n    Object.assign(userAttributes, getQpqAttributeObjectFromCognitoKeyValue(Name, Value));\n  }\n\n  return userAttributes;\n};\n"]}

package/lib/esm/logic/cognito/getUserAttributes.js

@@ -1,17 +1,15 @@
 import { AdminGetUserCommand, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';
 import { createAwsClient } from '../createAwsClient';
-import { getQpqAttributesFromCognitoUserAttributes } from './cognitoAttributeMap';
+import { getValidCognitoUserAttributes } from './utils/getValidCognitoUserAttributes';
+import { getQpqAttributesFromCognitoUserAttributes } from './getQpqAttributesFromCognitoUserAttributes';
 export const getUserAttributes = async (userPoolId, region, username) => {
     const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {
         region,
     });
-    const params = {
+    const response = await cognitoClient.send(new AdminGetUserCommand({
         UserPoolId: userPoolId,
         Username: username,
-    };
-    const response = await cognitoClient.send(new AdminGetUserCommand(params));
-    const validAttributes = (response.UserAttributes || []).filter((attr) => attr.Name && attr.Value);
-    const attributes = getQpqAttributesFromCognitoUserAttributes(validAttributes);
-    return attributes;
+    }));
+    return getQpqAttributesFromCognitoUserAttributes(getValidCognitoUserAttributes(response.UserAttributes));
 };
 //# sourceMappingURL=getUserAttributes.js.map

package/lib/esm/logic/cognito/getUserAttributes.js.map

@@ -1 +1 @@
-{"version":3,"file":"getUserAttributes.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getUserAttributes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAE/G,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,yCAAyC,EAAE,MAAM,uBAAuB,CAAC;AAElF,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,UAAkB,EAAE,MAAc,EAAE,QAAgB,EAA2B,EAAE;IACvH,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;KACnB,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IAE3E,MAAM,eAAe,GAAG,CAAC,QAAQ,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAsC,CAAC;IAEvI,MAAM,UAAU,GAAG,yCAAyC,CAAC,eAAe,CAAC,CAAC;IAE9E,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { AdminGetUserCommand, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getQpqAttributesFromCognitoUserAttributes } from './cognitoAttributeMap';\n\nexport const getUserAttributes = async (userPoolId: string, region: string, username: string): Promise<UserAttributes> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params = {\n    UserPoolId: userPoolId,\n    Username: username,\n  };\n\n  const response = await cognitoClient.send(new AdminGetUserCommand(params));\n\n  const validAttributes = (response.UserAttributes || []).filter((attr) => attr.Name && attr.Value) as { Name: string; Value: string }[];\n\n  const attributes = getQpqAttributesFromCognitoUserAttributes(validAttributes);\n\n  return attributes;\n};\n"]}
+{"version":3,"file":"getUserAttributes.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getUserAttributes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAE/G,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,yCAAyC,EAAE,MAAM,6CAA6C,CAAC;AAExG,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,UAAkB,EAAE,MAAc,EAAE,QAAgB,EAA2B,EAAE;IACvH,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CACvC,IAAI,mBAAmB,CAAC;QACtB,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;KACnB,CAAC,CACH,CAAC;IAEF,OAAO,yCAAyC,CAAC,6BAA6B,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;AAC3G,CAAC,CAAC","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { AdminGetUserCommand, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getValidCognitoUserAttributes } from './utils/getValidCognitoUserAttributes';\nimport { getQpqAttributesFromCognitoUserAttributes } from './getQpqAttributesFromCognitoUserAttributes';\n\nexport const getUserAttributes = async (userPoolId: string, region: string, username: string): Promise<UserAttributes> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response = await cognitoClient.send(\n    new AdminGetUserCommand({\n      UserPoolId: userPoolId,\n      Username: username,\n    }),\n  );\n\n  return getQpqAttributesFromCognitoUserAttributes(getValidCognitoUserAttributes(response.UserAttributes));\n};\n"]}