quidproquo-actionprocessor-awslambda 0.1.11 → 0.1.13

package/lib/esm/logic/cognito/getUserAttributesBySub.js

@@ -1,6 +1,8 @@
 import { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';
 import { createAwsClient } from '../createAwsClient';
-import { getQpqAttributesFromCognitoUserAttributes } from './cognitoAttributeMap';
+import { buildCognitoUserFilter, InvalidCognitoFilterError } from './utils/buildCognitoUserFilter';
+import { getValidCognitoUserAttributes } from './utils/getValidCognitoUserAttributes';
+import { getQpqAttributesFromCognitoUserAttributes } from './getQpqAttributesFromCognitoUserAttributes';
 // ListUsers returns an empty list rather than throwing for no match, so we throw
 // our own error with a discriminable `code` for the processor's catch to map.
 export class UserNotFoundError extends Error {
@@ -10,19 +12,32 @@ export class UserNotFoundError extends Error {
         this.name = 'UserNotFoundError';
     }
 }
+// A sub that cannot be embedded in a Cognito filter cannot belong to any user,
+// so unsafe input resolves to not-found instead of reaching Cognito.
+const buildSubFilter = (sub) => {
+    try {
+        return buildCognitoUserFilter('sub', sub);
+    }
+    catch (error) {
+        if (error instanceof InvalidCognitoFilterError) {
+            throw new UserNotFoundError();
+        }
+        throw error;
+    }
+};
 export const getUserAttributesBySub = async (userPoolId, region, sub) => {
+    const filter = buildSubFilter(sub);
     const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {
         region,
     });
     const response = await cognitoClient.send(new ListUsersCommand({
         UserPoolId: userPoolId,
-        Filter: `sub = "${sub}"`,
+        Filter: filter,
     }));
     const [user] = response?.Users || [];
     if (!user) {
         throw new UserNotFoundError();
     }
-    const validAttributes = (user.Attributes || []).filter((attr) => attr.Name && attr.Value);
-    return getQpqAttributesFromCognitoUserAttributes(validAttributes);
+    return getQpqAttributesFromCognitoUserAttributes(getValidCognitoUserAttributes(user.Attributes));
 };
 //# sourceMappingURL=getUserAttributesBySub.js.map

package/lib/esm/logic/cognito/getUserAttributesBySub.js.map

@@ -1 +1 @@
-{"version":3,"file":"getUserAttributesBySub.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getUserAttributesBySub.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,6BAA6B,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAE5G,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,yCAAyC,EAAE,MAAM,uBAAuB,CAAC;AAElF,iFAAiF;AACjF,8EAA8E;AAC9E,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,GAAG,gBAAgB,CAAC;IAEjC;QACE,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EAAE,UAAkB,EAAE,MAAc,EAAE,GAAW,EAA2B,EAAE;IACvH,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CACvC,IAAI,gBAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,MAAM,EAAE,UAAU,GAAG,GAAG;KACzB,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAGrF,CAAC;IAEJ,OAAO,yCAAyC,CAAC,eAAe,CAAC,CAAC;AACpE,CAAC,CAAC","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getQpqAttributesFromCognitoUserAttributes } from './cognitoAttributeMap';\n\n// ListUsers returns an empty list rather than throwing for no match, so we throw\n// our own error with a discriminable `code` for the processor's catch to map.\nexport class UserNotFoundError extends Error {\n  readonly code = 'USER_NOT_FOUND';\n\n  constructor() {\n    super('User not found');\n    this.name = 'UserNotFoundError';\n  }\n}\n\nexport const getUserAttributesBySub = async (userPoolId: string, region: string, sub: string): Promise<UserAttributes> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      Filter: `sub = \"${sub}\"`,\n    }),\n  );\n\n  const [user] = response?.Users || [];\n  if (!user) {\n    throw new UserNotFoundError();\n  }\n\n  const validAttributes = (user.Attributes || []).filter((attr) => attr.Name && attr.Value) as {\n    Name: string;\n    Value: string;\n  }[];\n\n  return getQpqAttributesFromCognitoUserAttributes(validAttributes);\n};\n"]}
+{"version":3,"file":"getUserAttributesBySub.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getUserAttributesBySub.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,6BAA6B,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAE5G,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AACnG,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,yCAAyC,EAAE,MAAM,6CAA6C,CAAC;AAExG,iFAAiF;AACjF,8EAA8E;AAC9E,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,GAAG,gBAAgB,CAAC;IAEjC;QACE,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,+EAA+E;AAC/E,qEAAqE;AACrE,MAAM,cAAc,GAAG,CAAC,GAAW,EAAU,EAAE;IAC7C,IAAI,CAAC;QACH,OAAO,sBAAsB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;YAC/C,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAChC,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EAAE,UAAkB,EAAE,MAAc,EAAE,GAAW,EAA2B,EAAE;IACvH,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAEnC,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CACvC,IAAI,gBAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,MAAM,EAAE,MAAM;KACf,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAChC,CAAC;IAED,OAAO,yCAAyC,CAAC,6BAA6B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;AACnG,CAAC,CAAC","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { buildCognitoUserFilter, InvalidCognitoFilterError } from './utils/buildCognitoUserFilter';\nimport { getValidCognitoUserAttributes } from './utils/getValidCognitoUserAttributes';\nimport { getQpqAttributesFromCognitoUserAttributes } from './getQpqAttributesFromCognitoUserAttributes';\n\n// ListUsers returns an empty list rather than throwing for no match, so we throw\n// our own error with a discriminable `code` for the processor's catch to map.\nexport class UserNotFoundError extends Error {\n  readonly code = 'USER_NOT_FOUND';\n\n  constructor() {\n    super('User not found');\n    this.name = 'UserNotFoundError';\n  }\n}\n\n// A sub that cannot be embedded in a Cognito filter cannot belong to any user,\n// so unsafe input resolves to not-found instead of reaching Cognito.\nconst buildSubFilter = (sub: string): string => {\n  try {\n    return buildCognitoUserFilter('sub', sub);\n  } catch (error) {\n    if (error instanceof InvalidCognitoFilterError) {\n      throw new UserNotFoundError();\n    }\n    throw error;\n  }\n};\n\nexport const getUserAttributesBySub = async (userPoolId: string, region: string, sub: string): Promise<UserAttributes> => {\n  const filter = buildSubFilter(sub);\n\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      Filter: filter,\n    }),\n  );\n\n  const [user] = response?.Users || [];\n  if (!user) {\n    throw new UserNotFoundError();\n  }\n\n  return getQpqAttributesFromCognitoUserAttributes(getValidCognitoUserAttributes(user.Attributes));\n};\n"]}

package/lib/esm/logic/cognito/getUserPoolClientSecret.d.ts

@@ -1 +1,9 @@
+export declare class ClientSecretNotFoundError extends Error {
+    readonly code = "CLIENT_SECRET_NOT_FOUND";
+    constructor();
+}
+/**
+ * Fetches the app client's secret (needed to compute the SECRET_HASH for auth
+ * flows). Throws ClientSecretNotFoundError when the client has no secret.
+ */
 export declare const getUserPoolClientSecret: (userPoolId: string, clientId: string, region: string) => Promise<string>;

package/lib/esm/logic/cognito/getUserPoolClientSecret.js

@@ -1,5 +1,18 @@
 import { CognitoIdentityProviderClient, DescribeUserPoolClientCommand, } from '@aws-sdk/client-cognito-identity-provider';
 import { createAwsClient } from '../createAwsClient';
+// DescribeUserPoolClient succeeds even when the app client has no secret, so a
+// missing secret is a hand-thrown, discriminable configuration error.
+export class ClientSecretNotFoundError extends Error {
+    code = 'CLIENT_SECRET_NOT_FOUND';
+    constructor() {
+        super('Can not find client secret for Cognito user pool client');
+        this.name = 'ClientSecretNotFoundError';
+    }
+}
+/**
+ * Fetches the app client's secret (needed to compute the SECRET_HASH for auth
+ * flows). Throws ClientSecretNotFoundError when the client has no secret.
+ */
 export const getUserPoolClientSecret = async (userPoolId, clientId, region) => {
     const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {
         region,
@@ -9,9 +22,10 @@ export const getUserPoolClientSecret = async (userPoolId, clientId, region) => {
         UserPoolId: userPoolId,
     };
     const response = await cognitoClient.send(new DescribeUserPoolClientCommand(params));
-    if (!response.UserPoolClient?.ClientSecret) {
-        throw new Error('Can not find client secret for Cognito user pool client');
+    const clientSecret = response.UserPoolClient?.ClientSecret;
+    if (!clientSecret) {
+        throw new ClientSecretNotFoundError();
     }
-    return response.UserPoolClient?.ClientSecret;
+    return clientSecret;
 };
 //# sourceMappingURL=getUserPoolClientSecret.js.map

package/lib/esm/logic/cognito/getUserPoolClientSecret.js.map

@@ -1 +1 @@
-{"version":3,"file":"getUserPoolClientSecret.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getUserPoolClientSecret.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,GAE9B,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,EAAE,UAAkB,EAAE,QAAgB,EAAE,MAAc,EAAmB,EAAE;IACrH,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAAuC;QACjD,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,UAAU;KACvB,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,6BAA6B,CAAC,MAAM,CAAC,CAAC,CAAC;IAErF,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,YAAY,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC;AAC/C,CAAC,CAAC","sourcesContent":["import {\n  CognitoIdentityProviderClient,\n  DescribeUserPoolClientCommand,\n  DescribeUserPoolClientCommandInput,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\n\nexport const getUserPoolClientSecret = async (userPoolId: string, clientId: string, region: string): Promise<string> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params: DescribeUserPoolClientCommandInput = {\n    ClientId: clientId,\n    UserPoolId: userPoolId,\n  };\n\n  const response = await cognitoClient.send(new DescribeUserPoolClientCommand(params));\n\n  if (!response.UserPoolClient?.ClientSecret) {\n    throw new Error('Can not find client secret for Cognito user pool client');\n  }\n\n  return response.UserPoolClient?.ClientSecret;\n};\n"]}
+{"version":3,"file":"getUserPoolClientSecret.js","sourceRoot":"","sources":["../../../../src/logic/cognito/getUserPoolClientSecret.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,GAE9B,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,+EAA+E;AAC/E,sEAAsE;AACtE,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,IAAI,GAAG,yBAAyB,CAAC;IAE1C;QACE,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,EAAE,UAAkB,EAAE,QAAgB,EAAE,MAAc,EAAmB,EAAE;IACrH,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAAuC;QACjD,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,UAAU;KACvB,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,6BAA6B,CAAC,MAAM,CAAC,CAAC,CAAC;IAErF,MAAM,YAAY,GAAG,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC;IAC3D,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,yBAAyB,EAAE,CAAC;IACxC,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC,CAAC","sourcesContent":["import {\n  CognitoIdentityProviderClient,\n  DescribeUserPoolClientCommand,\n  DescribeUserPoolClientCommandInput,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\n\n// DescribeUserPoolClient succeeds even when the app client has no secret, so a\n// missing secret is a hand-thrown, discriminable configuration error.\nexport class ClientSecretNotFoundError extends Error {\n  readonly code = 'CLIENT_SECRET_NOT_FOUND';\n\n  constructor() {\n    super('Can not find client secret for Cognito user pool client');\n    this.name = 'ClientSecretNotFoundError';\n  }\n}\n\n/**\n * Fetches the app client's secret (needed to compute the SECRET_HASH for auth\n * flows). Throws ClientSecretNotFoundError when the client has no secret.\n */\nexport const getUserPoolClientSecret = async (userPoolId: string, clientId: string, region: string): Promise<string> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params: DescribeUserPoolClientCommandInput = {\n    ClientId: clientId,\n    UserPoolId: userPoolId,\n  };\n\n  const response = await cognitoClient.send(new DescribeUserPoolClientCommand(params));\n\n  const clientSecret = response.UserPoolClient?.ClientSecret;\n  if (!clientSecret) {\n    throw new ClientSecretNotFoundError();\n  }\n\n  return clientSecret;\n};\n"]}

package/lib/esm/logic/cognito/index.js

@@ -1,3 +1,6 @@
+// Deliberately curated: this barrel is re-exported from the package root (via
+// src/logic/index.ts), so everything here is public API. Internal consumers
+// import sibling files directly; only add here to grow the public surface.
 export * from './decodeAccessToken';
 export * from './decodeValidJwt';
 export * from './globalSignOut';

package/lib/esm/logic/cognito/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/logic/cognito/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC","sourcesContent":["export * from './decodeAccessToken';\nexport * from './decodeValidJwt';\nexport * from './globalSignOut';\nexport * from './revokeRefreshToken';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/logic/cognito/index.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC","sourcesContent":["// Deliberately curated: this barrel is re-exported from the package root (via\n// src/logic/index.ts), so everything here is public API. Internal consumers\n// import sibling files directly; only add here to grow the public surface.\nexport * from './decodeAccessToken';\nexport * from './decodeValidJwt';\nexport * from './globalSignOut';\nexport * from './revokeRefreshToken';\n"]}

package/lib/esm/logic/cognito/listPagedUsers.js

@@ -1,7 +1,7 @@
 import { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';
 import { createAwsClient } from '../createAwsClient';
-import { getQpqAttributesFromCognitoUserAttributes } from './cognitoAttributeMap';
-import { pageKeyToPaginationToken, paginationTokenToPageKey } from './utils';
+import { getQpqAttributesFromCognitoUserAttributes } from './getQpqAttributesFromCognitoUserAttributes';
+import { getValidCognitoUserAttributes, pageKeyToPaginationToken, paginationTokenToPageKey } from './utils';
 export const listPagedUsers = async (userPoolId, region, pageKey) => {
     const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {
         region,
@@ -10,13 +10,9 @@ export const listPagedUsers = async (userPoolId, region, pageKey) => {
         UserPoolId: userPoolId,
         PaginationToken: pageKeyToPaginationToken(pageKey),
     }));
-    const users = (response.Users || []).map((user) => {
-        const validAttributes = (user.Attributes || []).filter((attr) => attr.Name && attr.Value);
-        return getQpqAttributesFromCognitoUserAttributes(validAttributes);
-    });
     return {
         nextPageKey: paginationTokenToPageKey(response.PaginationToken),
-        items: users,
+        items: (response.Users || []).map((user) => getQpqAttributesFromCognitoUserAttributes(getValidCognitoUserAttributes(user.Attributes))),
     };
 };
 //# sourceMappingURL=listPagedUsers.js.map

package/lib/esm/logic/cognito/listPagedUsers.js.map

@@ -1 +1 @@
-{"version":3,"file":"listPagedUsers.js","sourceRoot":"","sources":["../../../../src/logic/cognito/listPagedUsers.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,6BAA6B,EAAE,gBAAgB,EAAqB,MAAM,2CAA2C,CAAC;AAE/H,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,yCAAyC,EAAE,MAAM,uBAAuB,CAAC;AAClF,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAC;AAE7E,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,UAAkB,EAAE,MAAc,EAAE,OAAgB,EAAyC,EAAE;IAClI,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAsB,MAAM,aAAa,CAAC,IAAI,CAC1D,IAAI,gBAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,eAAe,EAAE,wBAAwB,CAAC,OAAO,CAAC;KACnD,CAAC,CACH,CAAC;IAEF,MAAM,KAAK,GAAqB,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAClE,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAGrF,CAAC;QAEJ,OAAO,yCAAyC,CAAC,eAAe,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,WAAW,EAAE,wBAAwB,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC/D,KAAK,EAAE,KAAK;KACb,CAAC;AACJ,CAAC,CAAC","sourcesContent":["import { QpqPagedData, UserAttributes } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ListUsersCommand, ListUsersResponse } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getQpqAttributesFromCognitoUserAttributes } from './cognitoAttributeMap';\nimport { pageKeyToPaginationToken, paginationTokenToPageKey } from './utils';\n\nexport const listPagedUsers = async (userPoolId: string, region: string, pageKey?: string): Promise<QpqPagedData<UserAttributes>> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response: ListUsersResponse = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      PaginationToken: pageKeyToPaginationToken(pageKey),\n    }),\n  );\n\n  const users: UserAttributes[] = (response.Users || []).map((user) => {\n    const validAttributes = (user.Attributes || []).filter((attr) => attr.Name && attr.Value) as {\n      Name: string;\n      Value: string;\n    }[];\n\n    return getQpqAttributesFromCognitoUserAttributes(validAttributes);\n  });\n\n  return {\n    nextPageKey: paginationTokenToPageKey(response.PaginationToken),\n    items: users,\n  };\n};\n"]}
+{"version":3,"file":"listPagedUsers.js","sourceRoot":"","sources":["../../../../src/logic/cognito/listPagedUsers.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,6BAA6B,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAE5G,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,yCAAyC,EAAE,MAAM,6CAA6C,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAC;AAE5G,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,UAAkB,EAAE,MAAc,EAAE,OAAgB,EAAyC,EAAE;IAClI,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CACvC,IAAI,gBAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,eAAe,EAAE,wBAAwB,CAAC,OAAO,CAAC;KACnD,CAAC,CACH,CAAC;IAEF,OAAO;QACL,WAAW,EAAE,wBAAwB,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC/D,KAAK,EAAE,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,yCAAyC,CAAC,6BAA6B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;KACvI,CAAC;AACJ,CAAC,CAAC","sourcesContent":["import { QpqPagedData, UserAttributes } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getQpqAttributesFromCognitoUserAttributes } from './getQpqAttributesFromCognitoUserAttributes';\nimport { getValidCognitoUserAttributes, pageKeyToPaginationToken, paginationTokenToPageKey } from './utils';\n\nexport const listPagedUsers = async (userPoolId: string, region: string, pageKey?: string): Promise<QpqPagedData<UserAttributes>> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      PaginationToken: pageKeyToPaginationToken(pageKey),\n    }),\n  );\n\n  return {\n    nextPageKey: paginationTokenToPageKey(response.PaginationToken),\n    items: (response.Users || []).map((user) => getQpqAttributesFromCognitoUserAttributes(getValidCognitoUserAttributes(user.Attributes))),\n  };\n};\n"]}

package/lib/esm/logic/cognito/listPagedUsersByAttribute.d.ts

@@ -1,2 +1,7 @@
 import { QpqPagedData, UserAttributes } from 'quidproquo-core';
+/**
+ * Lists users whose attribute exactly matches the given value.
+ * Throws InvalidCognitoFilterError (code INVALID_COGNITO_FILTER) when the
+ * attribute name or value cannot be embedded safely in a Cognito filter.
+ */
 export declare const listPagedUsersByAttribute: (userPoolId: string, region: string, attributeName: string, attributeValue: string, limit?: number, pageKey?: string) => Promise<QpqPagedData<UserAttributes>>;

package/lib/esm/logic/cognito/listPagedUsersByAttribute.js

@@ -1,7 +1,12 @@
 import { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';
 import { createAwsClient } from '../createAwsClient';
-import { getQpqAttributesFromCognitoUserAttributes } from './cognitoAttributeMap';
-import { pageKeyToPaginationToken, paginationTokenToPageKey } from './utils';
+import { getQpqAttributesFromCognitoUserAttributes } from './getQpqAttributesFromCognitoUserAttributes';
+import { buildCognitoUserFilter, getValidCognitoUserAttributes, pageKeyToPaginationToken, paginationTokenToPageKey } from './utils';
+/**
+ * Lists users whose attribute exactly matches the given value.
+ * Throws InvalidCognitoFilterError (code INVALID_COGNITO_FILTER) when the
+ * attribute name or value cannot be embedded safely in a Cognito filter.
+ */
 export const listPagedUsersByAttribute = async (userPoolId, region, attributeName, attributeValue, limit, pageKey) => {
     const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {
         region,
@@ -9,16 +14,12 @@ export const listPagedUsersByAttribute = async (userPoolId, region, attributeNam
     const response = await cognitoClient.send(new ListUsersCommand({
         UserPoolId: userPoolId,
         Limit: limit,
-        Filter: `${attributeName} = "${attributeValue}"`,
+        Filter: buildCognitoUserFilter(attributeName, attributeValue),
         PaginationToken: pageKeyToPaginationToken(pageKey),
     }));
-    const users = (response.Users || []).map((user) => {
-        const validAttributes = (user.Attributes || []).filter((attr) => attr.Name && attr.Value);
-        return getQpqAttributesFromCognitoUserAttributes(validAttributes);
-    });
     return {
         nextPageKey: paginationTokenToPageKey(response.PaginationToken),
-        items: users,
+        items: (response.Users || []).map((user) => getQpqAttributesFromCognitoUserAttributes(getValidCognitoUserAttributes(user.Attributes))),
     };
 };
 //# sourceMappingURL=listPagedUsersByAttribute.js.map

package/lib/esm/logic/cognito/listPagedUsersByAttribute.js.map

@@ -1 +1 @@
-{"version":3,"file":"listPagedUsersByAttribute.js","sourceRoot":"","sources":["../../../../src/logic/cognito/listPagedUsersByAttribute.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,6BAA6B,EAAE,gBAAgB,EAAqB,MAAM,2CAA2C,CAAC;AAE/H,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,yCAAyC,EAAE,MAAM,uBAAuB,CAAC;AAClF,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAC;AAE7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,EAC5C,UAAkB,EAClB,MAAc,EACd,aAAqB,EACrB,cAAsB,EACtB,KAAc,EACd,OAAgB,EACuB,EAAE;IACzC,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAsB,MAAM,aAAa,CAAC,IAAI,CAC1D,IAAI,gBAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,GAAG,aAAa,OAAO,cAAc,GAAG;QAChD,eAAe,EAAE,wBAAwB,CAAC,OAAO,CAAC;KACnD,CAAC,CACH,CAAC;IAEF,MAAM,KAAK,GAAqB,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAClE,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAGrF,CAAC;QAEJ,OAAO,yCAAyC,CAAC,eAAe,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,WAAW,EAAE,wBAAwB,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC/D,KAAK,EAAE,KAAK;KACb,CAAC;AACJ,CAAC,CAAC","sourcesContent":["import { QpqPagedData, UserAttributes } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ListUsersCommand, ListUsersResponse } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getQpqAttributesFromCognitoUserAttributes } from './cognitoAttributeMap';\nimport { pageKeyToPaginationToken, paginationTokenToPageKey } from './utils';\n\nexport const listPagedUsersByAttribute = async (\n  userPoolId: string,\n  region: string,\n  attributeName: string,\n  attributeValue: string,\n  limit?: number,\n  pageKey?: string,\n): Promise<QpqPagedData<UserAttributes>> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response: ListUsersResponse = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      Limit: limit,\n      Filter: `${attributeName} = \"${attributeValue}\"`,\n      PaginationToken: pageKeyToPaginationToken(pageKey),\n    }),\n  );\n\n  const users: UserAttributes[] = (response.Users || []).map((user) => {\n    const validAttributes = (user.Attributes || []).filter((attr) => attr.Name && attr.Value) as {\n      Name: string;\n      Value: string;\n    }[];\n\n    return getQpqAttributesFromCognitoUserAttributes(validAttributes);\n  });\n\n  return {\n    nextPageKey: paginationTokenToPageKey(response.PaginationToken),\n    items: users,\n  };\n};\n"]}
+{"version":3,"file":"listPagedUsersByAttribute.js","sourceRoot":"","sources":["../../../../src/logic/cognito/listPagedUsersByAttribute.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,6BAA6B,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAE5G,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,yCAAyC,EAAE,MAAM,6CAA6C,CAAC;AACxG,OAAO,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAC;AAEpI;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,EAC5C,UAAkB,EAClB,MAAc,EACd,aAAqB,EACrB,cAAsB,EACtB,KAAc,EACd,OAAgB,EACuB,EAAE;IACzC,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CACvC,IAAI,gBAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,sBAAsB,CAAC,aAAa,EAAE,cAAc,CAAC;QAC7D,eAAe,EAAE,wBAAwB,CAAC,OAAO,CAAC;KACnD,CAAC,CACH,CAAC;IAEF,OAAO;QACL,WAAW,EAAE,wBAAwB,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC/D,KAAK,EAAE,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,yCAAyC,CAAC,6BAA6B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;KACvI,CAAC;AACJ,CAAC,CAAC","sourcesContent":["import { QpqPagedData, UserAttributes } from 'quidproquo-core';\n\nimport { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getQpqAttributesFromCognitoUserAttributes } from './getQpqAttributesFromCognitoUserAttributes';\nimport { buildCognitoUserFilter, getValidCognitoUserAttributes, pageKeyToPaginationToken, paginationTokenToPageKey } from './utils';\n\n/**\n * Lists users whose attribute exactly matches the given value.\n * Throws InvalidCognitoFilterError (code INVALID_COGNITO_FILTER) when the\n * attribute name or value cannot be embedded safely in a Cognito filter.\n */\nexport const listPagedUsersByAttribute = async (\n  userPoolId: string,\n  region: string,\n  attributeName: string,\n  attributeValue: string,\n  limit?: number,\n  pageKey?: string,\n): Promise<QpqPagedData<UserAttributes>> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      Limit: limit,\n      Filter: buildCognitoUserFilter(attributeName, attributeValue),\n      PaginationToken: pageKeyToPaginationToken(pageKey),\n    }),\n  );\n\n  return {\n    nextPageKey: paginationTokenToPageKey(response.PaginationToken),\n    items: (response.Users || []).map((user) => getQpqAttributesFromCognitoUserAttributes(getValidCognitoUserAttributes(user.Attributes))),\n  };\n};\n"]}

package/lib/esm/logic/cognito/refreshToken.js

@@ -1,7 +1,7 @@
 import { AdminInitiateAuthCommand, AuthFlowType, CognitoIdentityProviderClient, } from '@aws-sdk/client-cognito-identity-provider';
 import { createAwsClient } from '../createAwsClient';
 import { calculateSecretHash } from './utils/calculateSecretHash';
-import { cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo } from './utils/transformCognitoResponse';
+import { cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo } from './utils/cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo';
 import { getUserPoolClientSecret } from './getUserPoolClientSecret';
 export const refreshToken = async (userPoolId, clientId, region, username, refreshToken) => {
     const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {
@@ -18,15 +18,16 @@ export const refreshToken = async (userPoolId, clientId, region, username, refre
             SECRET_HASH: secretHash,
         },
     };
-    // Time we issued the request
+    // Token expiry is computed relative to this; captured before the call so the
+    // derived expiresAt errs early rather than late.
     const issueDateTime = new Date().toISOString();
     const response = await cognitoClient.send(new AdminInitiateAuthCommand(params));
     const authResponse = cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo(response, issueDateTime);
-    // Cognito's REFRESH_TOKEN_AUTH flow does NOT return a refresh token — the existing one stays
-    // valid and is reused — so AuthenticationResult.RefreshToken is undefined here. Carry the
-    // caller's refresh token forward so the client keeps a usable session; without this it's
-    // dropped after the first refresh and the session can never refresh again. (If refresh-token
-    // rotation is ever enabled, Cognito DOES return a new one — then we keep that instead.)
+    // With rotation disabled, Cognito's REFRESH_TOKEN_AUTH flow does not return a
+    // refresh token: the existing one stays valid and is reused. Carry the caller's
+    // token forward so the client keeps a usable session; without this it is dropped
+    // after the first refresh and the session can never refresh again. If rotation
+    // is ever enabled Cognito does return a new token, and that one wins.
     if (authResponse.authenticationInfo && !authResponse.authenticationInfo.refreshToken) {
         authResponse.authenticationInfo.refreshToken = refreshToken;
     }

package/lib/esm/logic/cognito/refreshToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"refreshToken.js","sourceRoot":"","sources":["../../../../src/logic/cognito/refreshToken.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,wBAAwB,EAExB,YAAY,EACZ,6BAA6B,GAC9B,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,uDAAuD,EAAE,MAAM,kCAAkC,CAAC;AAC3G,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,QAAgB,EAChB,YAAoB,EACe,EAAE;IACrC,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAkC;QAC5C,QAAQ,EAAE,YAAY,CAAC,kBAAkB;QACzC,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAElB,cAAc,EAAE;YACd,aAAa,EAAE,YAAY;YAC3B,WAAW,EAAE,UAAU;SACxB;KACF,CAAC;IAEF,6BAA6B;IAC7B,MAAM,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhF,MAAM,YAAY,GAAG,uDAAuD,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAEtG,6FAA6F;IAC7F,0FAA0F;IAC1F,yFAAyF;IACzF,6FAA6F;IAC7F,wFAAwF;IACxF,IAAI,YAAY,CAAC,kBAAkB,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,YAAY,EAAE,CAAC;QACrF,YAAY,CAAC,kBAAkB,CAAC,YAAY,GAAG,YAAY,CAAC;IAC9D,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC,CAAC","sourcesContent":["import { AuthenticateUserResponse } from 'quidproquo-core';\n\nimport {\n  AdminInitiateAuthCommand,\n  AdminInitiateAuthCommandInput,\n  AuthFlowType,\n  CognitoIdentityProviderClient,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo } from './utils/transformCognitoResponse';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\nexport const refreshToken = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  username: string,\n  refreshToken: string,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  const params: AdminInitiateAuthCommandInput = {\n    AuthFlow: AuthFlowType.REFRESH_TOKEN_AUTH,\n    UserPoolId: userPoolId,\n    ClientId: clientId,\n\n    AuthParameters: {\n      REFRESH_TOKEN: refreshToken,\n      SECRET_HASH: secretHash,\n    },\n  };\n\n  // Time we issued the request\n  const issueDateTime = new Date().toISOString();\n  const response = await cognitoClient.send(new AdminInitiateAuthCommand(params));\n\n  const authResponse = cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo(response, issueDateTime);\n\n  // Cognito's REFRESH_TOKEN_AUTH flow does NOT return a refresh token — the existing one stays\n  // valid and is reused — so AuthenticationResult.RefreshToken is undefined here. Carry the\n  // caller's refresh token forward so the client keeps a usable session; without this it's\n  // dropped after the first refresh and the session can never refresh again. (If refresh-token\n  // rotation is ever enabled, Cognito DOES return a new one — then we keep that instead.)\n  if (authResponse.authenticationInfo && !authResponse.authenticationInfo.refreshToken) {\n    authResponse.authenticationInfo.refreshToken = refreshToken;\n  }\n\n  return authResponse;\n};\n"]}
+{"version":3,"file":"refreshToken.js","sourceRoot":"","sources":["../../../../src/logic/cognito/refreshToken.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,wBAAwB,EAExB,YAAY,EACZ,6BAA6B,GAC9B,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,uDAAuD,EAAE,MAAM,iEAAiE,CAAC;AAC1I,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,QAAgB,EAChB,YAAoB,EACe,EAAE;IACrC,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAkC;QAC5C,QAAQ,EAAE,YAAY,CAAC,kBAAkB;QACzC,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAElB,cAAc,EAAE;YACd,aAAa,EAAE,YAAY;YAC3B,WAAW,EAAE,UAAU;SACxB;KACF,CAAC;IAEF,6EAA6E;IAC7E,iDAAiD;IACjD,MAAM,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhF,MAAM,YAAY,GAAG,uDAAuD,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAEtG,8EAA8E;IAC9E,gFAAgF;IAChF,iFAAiF;IACjF,+EAA+E;IAC/E,sEAAsE;IACtE,IAAI,YAAY,CAAC,kBAAkB,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,YAAY,EAAE,CAAC;QACrF,YAAY,CAAC,kBAAkB,CAAC,YAAY,GAAG,YAAY,CAAC;IAC9D,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC,CAAC","sourcesContent":["import { AuthenticateUserResponse } from 'quidproquo-core';\n\nimport {\n  AdminInitiateAuthCommand,\n  AdminInitiateAuthCommandInput,\n  AuthFlowType,\n  CognitoIdentityProviderClient,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo } from './utils/cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\nexport const refreshToken = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  username: string,\n  refreshToken: string,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  const params: AdminInitiateAuthCommandInput = {\n    AuthFlow: AuthFlowType.REFRESH_TOKEN_AUTH,\n    UserPoolId: userPoolId,\n    ClientId: clientId,\n\n    AuthParameters: {\n      REFRESH_TOKEN: refreshToken,\n      SECRET_HASH: secretHash,\n    },\n  };\n\n  // Token expiry is computed relative to this; captured before the call so the\n  // derived expiresAt errs early rather than late.\n  const issueDateTime = new Date().toISOString();\n  const response = await cognitoClient.send(new AdminInitiateAuthCommand(params));\n\n  const authResponse = cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo(response, issueDateTime);\n\n  // With rotation disabled, Cognito's REFRESH_TOKEN_AUTH flow does not return a\n  // refresh token: the existing one stays valid and is reused. Carry the caller's\n  // token forward so the client keeps a usable session; without this it is dropped\n  // after the first refresh and the session can never refresh again. If rotation\n  // is ever enabled Cognito does return a new token, and that one wins.\n  if (authResponse.authenticationInfo && !authResponse.authenticationInfo.refreshToken) {\n    authResponse.authenticationInfo.refreshToken = refreshToken;\n  }\n\n  return authResponse;\n};\n"]}

package/lib/esm/logic/cognito/requestEmailVerificationCode.js

@@ -1,19 +1,15 @@
 import { CognitoIdentityProviderClient, GetUserAttributeVerificationCodeCommand, } from '@aws-sdk/client-cognito-identity-provider';
 import { createAwsClient } from '../createAwsClient';
+import { cognitoCodeDeliveryDetailsToQpqDeliveryDetails } from './utils/cognitoCodeDeliveryDetailsToQpqDeliveryDetails';
 export const requestEmailVerificationCode = async (region, accessToken) => {
     const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {
         region,
     });
     const params = {
         AccessToken: accessToken,
-        AttributeName: 'email', // Request verification for the email attribute
+        AttributeName: 'email',
     };
     const response = await cognitoClient.send(new GetUserAttributeVerificationCodeCommand(params));
-    const deliveryInfo = {
-        attributeName: response.CodeDeliveryDetails?.AttributeName || 'email',
-        destination: response.CodeDeliveryDetails?.Destination || 'unknown@email.com',
-        deliveryMedium: response.CodeDeliveryDetails?.DeliveryMedium || 'EMAIL',
-    };
-    return deliveryInfo;
+    return cognitoCodeDeliveryDetailsToQpqDeliveryDetails(response.CodeDeliveryDetails);
 };
 //# sourceMappingURL=requestEmailVerificationCode.js.map

package/lib/esm/logic/cognito/requestEmailVerificationCode.js.map

@@ -1 +1 @@
-{"version":3,"file":"requestEmailVerificationCode.js","sourceRoot":"","sources":["../../../../src/logic/cognito/requestEmailVerificationCode.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,6BAA6B,EAC7B,uCAAuC,GAExC,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,MAAc,EAAE,WAAmB,EAA0C,EAAE;IAChI,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAAiD;QAC3D,WAAW,EAAE,WAAW;QACxB,aAAa,EAAE,OAAO,EAAE,+CAA+C;KACxE,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,uCAAuC,CAAC,MAAM,CAAC,CAAC,CAAC;IAE/F,MAAM,YAAY,GAAG;QACnB,aAAa,EAAE,QAAQ,CAAC,mBAAmB,EAAE,aAAa,IAAI,OAAO;QACrE,WAAW,EAAE,QAAQ,CAAC,mBAAmB,EAAE,WAAW,IAAI,mBAAmB;QAC7E,cAAc,EAAE,QAAQ,CAAC,mBAAmB,EAAE,cAAc,IAAI,OAAO;KACvC,CAAC;IAEnC,OAAO,YAAY,CAAC;AACtB,CAAC,CAAC","sourcesContent":["import { AuthenticationDeliveryDetails } from 'quidproquo-core';\n\nimport {\n  CognitoIdentityProviderClient,\n  GetUserAttributeVerificationCodeCommand,\n  GetUserAttributeVerificationCodeCommandInput,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\n\nexport const requestEmailVerificationCode = async (region: string, accessToken: string): Promise<AuthenticationDeliveryDetails> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params: GetUserAttributeVerificationCodeCommandInput = {\n    AccessToken: accessToken,\n    AttributeName: 'email', // Request verification for the email attribute\n  };\n\n  const response = await cognitoClient.send(new GetUserAttributeVerificationCodeCommand(params));\n\n  const deliveryInfo = {\n    attributeName: response.CodeDeliveryDetails?.AttributeName || 'email',\n    destination: response.CodeDeliveryDetails?.Destination || 'unknown@email.com',\n    deliveryMedium: response.CodeDeliveryDetails?.DeliveryMedium || 'EMAIL',\n  } as AuthenticationDeliveryDetails;\n\n  return deliveryInfo;\n};\n"]}
+{"version":3,"file":"requestEmailVerificationCode.js","sourceRoot":"","sources":["../../../../src/logic/cognito/requestEmailVerificationCode.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,6BAA6B,EAC7B,uCAAuC,GAExC,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,8CAA8C,EAAE,MAAM,wDAAwD,CAAC;AAExH,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,MAAc,EAAE,WAAmB,EAA0C,EAAE;IAChI,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAAiD;QAC3D,WAAW,EAAE,WAAW;QACxB,aAAa,EAAE,OAAO;KACvB,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,uCAAuC,CAAC,MAAM,CAAC,CAAC,CAAC;IAE/F,OAAO,8CAA8C,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;AACtF,CAAC,CAAC","sourcesContent":["import { AuthenticationDeliveryDetails } from 'quidproquo-core';\n\nimport {\n  CognitoIdentityProviderClient,\n  GetUserAttributeVerificationCodeCommand,\n  GetUserAttributeVerificationCodeCommandInput,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { cognitoCodeDeliveryDetailsToQpqDeliveryDetails } from './utils/cognitoCodeDeliveryDetailsToQpqDeliveryDetails';\n\nexport const requestEmailVerificationCode = async (region: string, accessToken: string): Promise<AuthenticationDeliveryDetails> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params: GetUserAttributeVerificationCodeCommandInput = {\n    AccessToken: accessToken,\n    AttributeName: 'email',\n  };\n\n  const response = await cognitoClient.send(new GetUserAttributeVerificationCodeCommand(params));\n\n  return cognitoCodeDeliveryDetailsToQpqDeliveryDetails(response.CodeDeliveryDetails);\n};\n"]}

package/lib/esm/logic/cognito/resolveUsernameByPreferredUsername.d.ts

@@ -1 +1,6 @@
+/**
+ * Resolves a login alias (preferred_username) to the real Cognito username.
+ * Falls back to the input when nothing matches, so callers can pass either a
+ * preferred username or an actual username.
+ */
 export declare const resolveUsernameByPreferredUsername: (userPoolId: string, region: string, preferredUsername: string) => Promise<string>;

package/lib/esm/logic/cognito/resolveUsernameByPreferredUsername.js

@@ -1,15 +1,38 @@
 import { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';
 import { createAwsClient } from '../createAwsClient';
+import { buildCognitoUserFilter, InvalidCognitoFilterError } from './utils/buildCognitoUserFilter';
+// A value that cannot be embedded in a Cognito filter cannot be anyone's
+// preferred_username, so we skip the lookup and treat the input as an actual
+// username (the same fallback as a no-match lookup).
+const buildPreferredUsernameFilter = (preferredUsername) => {
+    try {
+        return buildCognitoUserFilter('preferred_username', preferredUsername);
+    }
+    catch (error) {
+        if (error instanceof InvalidCognitoFilterError) {
+            return null;
+        }
+        throw error;
+    }
+};
+/**
+ * Resolves a login alias (preferred_username) to the real Cognito username.
+ * Falls back to the input when nothing matches, so callers can pass either a
+ * preferred username or an actual username.
+ */
 export const resolveUsernameByPreferredUsername = async (userPoolId, region, preferredUsername) => {
+    const filter = buildPreferredUsernameFilter(preferredUsername);
+    if (!filter) {
+        return preferredUsername;
+    }
     const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {
         region,
     });
     const response = await cognitoClient.send(new ListUsersCommand({
         UserPoolId: userPoolId,
         Limit: 1,
-        Filter: `preferred_username = "${preferredUsername}"`,
+        Filter: filter,
     }));
-    const resolvedUsername = response.Users?.[0]?.Username;
-    return resolvedUsername || preferredUsername;
+    return response.Users?.[0]?.Username || preferredUsername;
 };
 //# sourceMappingURL=resolveUsernameByPreferredUsername.js.map

package/lib/esm/logic/cognito/resolveUsernameByPreferredUsername.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolveUsernameByPreferredUsername.js","sourceRoot":"","sources":["../../../../src/logic/cognito/resolveUsernameByPreferredUsername.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAE5G,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,CAAC,MAAM,kCAAkC,GAAG,KAAK,EAAE,UAAkB,EAAE,MAAc,EAAE,iBAAyB,EAAmB,EAAE;IACzI,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CACvC,IAAI,gBAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,yBAAyB,iBAAiB,GAAG;KACtD,CAAC,CACH,CAAC;IAEF,MAAM,gBAAgB,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;IAEvD,OAAO,gBAAgB,IAAI,iBAAiB,CAAC;AAC/C,CAAC,CAAC","sourcesContent":["import { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\n\nexport const resolveUsernameByPreferredUsername = async (userPoolId: string, region: string, preferredUsername: string): Promise<string> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      Limit: 1,\n      Filter: `preferred_username = \"${preferredUsername}\"`,\n    }),\n  );\n\n  const resolvedUsername = response.Users?.[0]?.Username;\n\n  return resolvedUsername || preferredUsername;\n};\n"]}
+{"version":3,"file":"resolveUsernameByPreferredUsername.js","sourceRoot":"","sources":["../../../../src/logic/cognito/resolveUsernameByPreferredUsername.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAE5G,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAEnG,yEAAyE;AACzE,6EAA6E;AAC7E,qDAAqD;AACrD,MAAM,4BAA4B,GAAG,CAAC,iBAAyB,EAAiB,EAAE;IAChF,IAAI,CAAC;QACH,OAAO,sBAAsB,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,KAAK,EAAE,UAAkB,EAAE,MAAc,EAAE,iBAAyB,EAAmB,EAAE;IACzI,MAAM,MAAM,GAAG,4BAA4B,CAAC,iBAAiB,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CACvC,IAAI,gBAAgB,CAAC;QACnB,UAAU,EAAE,UAAU;QACtB,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,MAAM;KACf,CAAC,CACH,CAAC;IAEF,OAAO,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,IAAI,iBAAiB,CAAC;AAC5D,CAAC,CAAC","sourcesContent":["import { CognitoIdentityProviderClient, ListUsersCommand } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { buildCognitoUserFilter, InvalidCognitoFilterError } from './utils/buildCognitoUserFilter';\n\n// A value that cannot be embedded in a Cognito filter cannot be anyone's\n// preferred_username, so we skip the lookup and treat the input as an actual\n// username (the same fallback as a no-match lookup).\nconst buildPreferredUsernameFilter = (preferredUsername: string): string | null => {\n  try {\n    return buildCognitoUserFilter('preferred_username', preferredUsername);\n  } catch (error) {\n    if (error instanceof InvalidCognitoFilterError) {\n      return null;\n    }\n    throw error;\n  }\n};\n\n/**\n * Resolves a login alias (preferred_username) to the real Cognito username.\n * Falls back to the input when nothing matches, so callers can pass either a\n * preferred username or an actual username.\n */\nexport const resolveUsernameByPreferredUsername = async (userPoolId: string, region: string, preferredUsername: string): Promise<string> => {\n  const filter = buildPreferredUsernameFilter(preferredUsername);\n  if (!filter) {\n    return preferredUsername;\n  }\n\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const response = await cognitoClient.send(\n    new ListUsersCommand({\n      UserPoolId: userPoolId,\n      Limit: 1,\n      Filter: filter,\n    }),\n  );\n\n  return response.Users?.[0]?.Username || preferredUsername;\n};\n"]}

package/lib/esm/logic/cognito/respondToAuthChallenge.d.ts

@@ -0,0 +1,8 @@
+import { AuthenticateUserResponse } from 'quidproquo-core';
+import { ChallengeNameType } from '@aws-sdk/client-cognito-identity-provider';
+/**
+ * Answers a pending Cognito auth challenge (new password, TOTP code, custom
+ * challenge, ...) using the session from the previous auth step. Returns either
+ * issued tokens or the next challenge.
+ */
+export declare const respondToAuthChallenge: (userPoolId: string, clientId: string, region: string, username: string, session: string, challengeNameType: ChallengeNameType, attributes: Record<string, string>) => Promise<AuthenticateUserResponse>;

package/lib/esm/logic/cognito/{respondToAuthChallengeChallenge.js → respondToAuthChallenge.js}

@@ -1,9 +1,14 @@
 import { CognitoIdentityProviderClient, RespondToAuthChallengeCommand, } from '@aws-sdk/client-cognito-identity-provider';
 import { createAwsClient } from '../createAwsClient';
 import { calculateSecretHash } from './utils/calculateSecretHash';
-import { cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo } from './utils/transformCognitoResponse';
+import { cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo } from './utils/cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo';
 import { getUserPoolClientSecret } from './getUserPoolClientSecret';
-export const respondToAuthChallengeChallenge = async (userPoolId, clientId, region, username, session, challengeNameType, attributes) => {
+/**
+ * Answers a pending Cognito auth challenge (new password, TOTP code, custom
+ * challenge, ...) using the session from the previous auth step. Returns either
+ * issued tokens or the next challenge.
+ */
+export const respondToAuthChallenge = async (userPoolId, clientId, region, username, session, challengeNameType, attributes) => {
     const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {
         region,
     });
@@ -19,9 +24,10 @@ export const respondToAuthChallengeChallenge = async (userPoolId, clientId, regi
             ...attributes,
         },
     };
+    // Token expiry is computed relative to this; captured before the call so the
+    // derived expiresAt errs early rather than late.
     const issueDateTime = new Date().toISOString();
     const response = await cognitoClient.send(new RespondToAuthChallengeCommand(params));
-    // transform the response into your custom format, similar to your refreshToken function
     return cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo(response, issueDateTime);
 };
-//# sourceMappingURL=respondToAuthChallengeChallenge.js.map
+//# sourceMappingURL=respondToAuthChallenge.js.map

package/lib/esm/logic/cognito/respondToAuthChallenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"respondToAuthChallenge.js","sourceRoot":"","sources":["../../../../src/logic/cognito/respondToAuthChallenge.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,6BAA6B,EAC7B,6BAA6B,GAE9B,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,uDAAuD,EAAE,MAAM,iEAAiE,CAAC;AAC1I,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEpE;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EACzC,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,QAAgB,EAChB,OAAe,EACf,iBAAoC,EACpC,UAAkC,EACC,EAAE;IACrC,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAuC;QACjD,aAAa,EAAE,iBAAiB;QAChC,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,OAAO;QAChB,kBAAkB,EAAE;YAClB,QAAQ,EAAE,QAAQ;YAClB,WAAW,EAAE,UAAU;YAEvB,GAAG,UAAU;SACd;KACF,CAAC;IAEF,6EAA6E;IAC7E,iDAAiD;IACjD,MAAM,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,6BAA6B,CAAC,MAAM,CAAC,CAAC,CAAC;IAErF,OAAO,uDAAuD,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AAC1F,CAAC,CAAC","sourcesContent":["import { AuthenticateUserResponse } from 'quidproquo-core';\n\nimport {\n  ChallengeNameType,\n  CognitoIdentityProviderClient,\n  RespondToAuthChallengeCommand,\n  RespondToAuthChallengeCommandInput,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo } from './utils/cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\n/**\n * Answers a pending Cognito auth challenge (new password, TOTP code, custom\n * challenge, ...) using the session from the previous auth step. Returns either\n * issued tokens or the next challenge.\n */\nexport const respondToAuthChallenge = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  username: string,\n  session: string,\n  challengeNameType: ChallengeNameType,\n  attributes: Record<string, string>,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  const params: RespondToAuthChallengeCommandInput = {\n    ChallengeName: challengeNameType,\n    ClientId: clientId,\n    Session: session,\n    ChallengeResponses: {\n      USERNAME: username,\n      SECRET_HASH: secretHash,\n\n      ...attributes,\n    },\n  };\n\n  // Token expiry is computed relative to this; captured before the call so the\n  // derived expiresAt errs early rather than late.\n  const issueDateTime = new Date().toISOString();\n  const response = await cognitoClient.send(new RespondToAuthChallengeCommand(params));\n\n  return cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo(response, issueDateTime);\n};\n"]}

package/lib/esm/logic/cognito/setUserAttributes.js

@@ -1,16 +1,16 @@
 import { AdminUpdateUserAttributesCommand, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';
 import { createAwsClient } from '../createAwsClient';
-import { getCognitoUserAttributesFromQpqUserAttributes } from './cognitoAttributeMap';
+import { getCognitoUserAttributesFromQpqUserAttributes } from './getCognitoUserAttributesFromQpqUserAttributes';
 export const setUserAttributes = async (userPoolId, region, username, userAttributes) => {
     const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {
         region,
     });
+    // userId maps to the immutable sub attribute, so it must never be written back.
     const { userId, ...writeableUserAttributes } = userAttributes;
-    const params = {
+    await cognitoClient.send(new AdminUpdateUserAttributesCommand({
         UserPoolId: userPoolId,
         Username: username,
         UserAttributes: getCognitoUserAttributesFromQpqUserAttributes(writeableUserAttributes),
-    };
-    await cognitoClient.send(new AdminUpdateUserAttributesCommand(params));
+    }));
 };
 //# sourceMappingURL=setUserAttributes.js.map

package/lib/esm/logic/cognito/setUserAttributes.js.map

@@ -1 +1 @@
-{"version":3,"file":"setUserAttributes.js","sourceRoot":"","sources":["../../../../src/logic/cognito/setUserAttributes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gCAAgC,EAAiB,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAE3I,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,6CAA6C,EAAE,MAAM,uBAAuB,CAAC;AAEtF,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,UAAkB,EAAE,MAAc,EAAE,QAAgB,EAAE,cAA8B,EAAiB,EAAE;IAC7I,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,EAAE,MAAM,EAAE,GAAG,uBAAuB,EAAE,GAAG,cAAc,CAAC;IAE9D,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAClB,cAAc,EAAE,6CAA6C,CAAC,uBAAuB,CAAC;KACvF,CAAC;IAEF,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,gCAAgC,CAAC,MAAM,CAAC,CAAC,CAAC;AACzE,CAAC,CAAC","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { AdminUpdateUserAttributesCommand, AttributeType, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getCognitoUserAttributesFromQpqUserAttributes } from './cognitoAttributeMap';\n\nexport const setUserAttributes = async (userPoolId: string, region: string, username: string, userAttributes: UserAttributes): Promise<void> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const { userId, ...writeableUserAttributes } = userAttributes;\n\n  const params = {\n    UserPoolId: userPoolId,\n    Username: username,\n    UserAttributes: getCognitoUserAttributesFromQpqUserAttributes(writeableUserAttributes),\n  };\n\n  await cognitoClient.send(new AdminUpdateUserAttributesCommand(params));\n};\n"]}
+{"version":3,"file":"setUserAttributes.js","sourceRoot":"","sources":["../../../../src/logic/cognito/setUserAttributes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gCAAgC,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAE5H,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,6CAA6C,EAAE,MAAM,iDAAiD,CAAC;AAEhH,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,UAAkB,EAAE,MAAc,EAAE,QAAgB,EAAE,cAA8B,EAAiB,EAAE;IAC7I,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,gFAAgF;IAChF,MAAM,EAAE,MAAM,EAAE,GAAG,uBAAuB,EAAE,GAAG,cAAc,CAAC;IAE9D,MAAM,aAAa,CAAC,IAAI,CACtB,IAAI,gCAAgC,CAAC;QACnC,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAClB,cAAc,EAAE,6CAA6C,CAAC,uBAAuB,CAAC;KACvF,CAAC,CACH,CAAC;AACJ,CAAC,CAAC","sourcesContent":["import { UserAttributes } from 'quidproquo-core';\n\nimport { AdminUpdateUserAttributesCommand, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getCognitoUserAttributesFromQpqUserAttributes } from './getCognitoUserAttributesFromQpqUserAttributes';\n\nexport const setUserAttributes = async (userPoolId: string, region: string, username: string, userAttributes: UserAttributes): Promise<void> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  // userId maps to the immutable sub attribute, so it must never be written back.\n  const { userId, ...writeableUserAttributes } = userAttributes;\n\n  await cognitoClient.send(\n    new AdminUpdateUserAttributesCommand({\n      UserPoolId: userPoolId,\n      Username: username,\n      UserAttributes: getCognitoUserAttributesFromQpqUserAttributes(writeableUserAttributes),\n    }),\n  );\n};\n"]}

package/lib/esm/logic/cognito/setUserPassword.js

@@ -4,11 +4,12 @@ export const setUserPassword = async (region, userPoolId, username, password) =>
     const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {
         region,
     });
-    // There has to be a better way than this?
     const passwordParams = {
         Password: password,
         Username: username,
         UserPoolId: userPoolId,
+        // Activate the password immediately rather than leaving the user in the
+        // FORCE_CHANGE_PASSWORD state a temporary password would.
         Permanent: true,
     };
     await cognitoClient.send(new AdminSetUserPasswordCommand(passwordParams));

package/lib/esm/logic/cognito/setUserPassword.js.map

@@ -1 +1 @@
-{"version":3,"file":"setUserPassword.js","sourceRoot":"","sources":["../../../../src/logic/cognito/setUserPassword.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAE3B,6BAA6B,GAC9B,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,MAAc,EAAE,UAAkB,EAAE,QAAgB,EAAE,QAAgB,EAAE,EAAE;IAC9G,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,0CAA0C;IAC1C,MAAM,cAAc,GAAqC;QACvD,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,UAAU;QACtB,SAAS,EAAE,IAAI;KAChB,CAAC;IAEF,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,2BAA2B,CAAC,cAAc,CAAC,CAAC,CAAC;AAC5E,CAAC,CAAC","sourcesContent":["import {\n  AdminSetUserPasswordCommand,\n  AdminSetUserPasswordCommandInput,\n  CognitoIdentityProviderClient,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\n\nexport const setUserPassword = async (region: string, userPoolId: string, username: string, password: string) => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  // There has to be a better way than this?\n  const passwordParams: AdminSetUserPasswordCommandInput = {\n    Password: password,\n    Username: username,\n    UserPoolId: userPoolId,\n    Permanent: true,\n  };\n\n  await cognitoClient.send(new AdminSetUserPasswordCommand(passwordParams));\n};\n"]}
+{"version":3,"file":"setUserPassword.js","sourceRoot":"","sources":["../../../../src/logic/cognito/setUserPassword.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAE3B,6BAA6B,GAC9B,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,MAAc,EAAE,UAAkB,EAAE,QAAgB,EAAE,QAAgB,EAAiB,EAAE;IAC7H,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,cAAc,GAAqC;QACvD,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,UAAU;QACtB,wEAAwE;QACxE,0DAA0D;QAC1D,SAAS,EAAE,IAAI;KAChB,CAAC;IAEF,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,2BAA2B,CAAC,cAAc,CAAC,CAAC,CAAC;AAC5E,CAAC,CAAC","sourcesContent":["import {\n  AdminSetUserPasswordCommand,\n  AdminSetUserPasswordCommandInput,\n  CognitoIdentityProviderClient,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\n\nexport const setUserPassword = async (region: string, userPoolId: string, username: string, password: string): Promise<void> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const passwordParams: AdminSetUserPasswordCommandInput = {\n    Password: password,\n    Username: username,\n    UserPoolId: userPoolId,\n    // Activate the password immediately rather than leaving the user in the\n    // FORCE_CHANGE_PASSWORD state a temporary password would.\n    Permanent: true,\n  };\n\n  await cognitoClient.send(new AdminSetUserPasswordCommand(passwordParams));\n};\n"]}

package/lib/esm/logic/cognito/utils/CognitoUserAttribute.d.ts

@@ -0,0 +1,5 @@
+/** A Cognito user attribute that is guaranteed to carry both a name and a value. */
+export type CognitoUserAttribute = {
+    Name: string;
+    Value: string;
+};

package/lib/esm/logic/cognito/utils/CognitoUserAttribute.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=CognitoUserAttribute.js.map

package/lib/esm/logic/cognito/utils/CognitoUserAttribute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CognitoUserAttribute.js","sourceRoot":"","sources":["../../../../../src/logic/cognito/utils/CognitoUserAttribute.ts"],"names":[],"mappings":"","sourcesContent":["/** A Cognito user attribute that is guaranteed to carry both a name and a value. */\nexport type CognitoUserAttribute = {\n  Name: string;\n  Value: string;\n};\n"]}

package/lib/esm/logic/cognito/utils/buildCognitoUserFilter.d.ts

@@ -0,0 +1,10 @@
+export declare class InvalidCognitoFilterError extends Error {
+    readonly code = "INVALID_COGNITO_FILTER";
+    constructor(message: string);
+}
+/**
+ * Builds a Cognito ListUsers exact-match filter (`name = "value"`), rejecting
+ * attribute names and values that cannot be embedded safely.
+ * Throws InvalidCognitoFilterError (code INVALID_COGNITO_FILTER) on unsafe input.
+ */
+export declare const buildCognitoUserFilter: (attributeName: string, attributeValue: string) => string;

package/lib/esm/logic/cognito/utils/buildCognitoUserFilter.js

@@ -0,0 +1,29 @@
+// ListUsers filter strings are built by interpolation, so a value containing a
+// quote or backslash could break out of the quoted literal and alter the filter.
+// Cognito defines no escaping for these, so unsafe input is rejected outright.
+export class InvalidCognitoFilterError extends Error {
+    code = 'INVALID_COGNITO_FILTER';
+    constructor(message) {
+        super(message);
+        this.name = 'InvalidCognitoFilterError';
+    }
+}
+// Cognito filterable attribute names: standard attributes plus prefixed ones
+// like cognito:user_status.
+const validAttributeName = /^[a-zA-Z][a-zA-Z0-9_:]*$/;
+/**
+ * Builds a Cognito ListUsers exact-match filter (`name = "value"`), rejecting
+ * attribute names and values that cannot be embedded safely.
+ * Throws InvalidCognitoFilterError (code INVALID_COGNITO_FILTER) on unsafe input.
+ */
+export const buildCognitoUserFilter = (attributeName, attributeValue) => {
+    if (!validAttributeName.test(attributeName)) {
+        throw new InvalidCognitoFilterError(`Invalid Cognito filter attribute name: ${attributeName}`);
+    }
+    // The value is deliberately not echoed into the message: it can be user input.
+    if (attributeValue.includes('"') || attributeValue.includes('\\')) {
+        throw new InvalidCognitoFilterError('Cognito filter values cannot contain quotes or backslashes');
+    }
+    return `${attributeName} = "${attributeValue}"`;
+};
+//# sourceMappingURL=buildCognitoUserFilter.js.map

package/lib/esm/logic/cognito/utils/buildCognitoUserFilter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildCognitoUserFilter.js","sourceRoot":"","sources":["../../../../../src/logic/cognito/utils/buildCognitoUserFilter.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,iFAAiF;AACjF,+EAA+E;AAC/E,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,IAAI,GAAG,wBAAwB,CAAC;IAEzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,6EAA6E;AAC7E,4BAA4B;AAC5B,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAEtD;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,aAAqB,EAAE,cAAsB,EAAU,EAAE;IAC9F,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,yBAAyB,CAAC,0CAA0C,aAAa,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,+EAA+E;IAC/E,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,yBAAyB,CAAC,4DAA4D,CAAC,CAAC;IACpG,CAAC;IAED,OAAO,GAAG,aAAa,OAAO,cAAc,GAAG,CAAC;AAClD,CAAC,CAAC","sourcesContent":["// ListUsers filter strings are built by interpolation, so a value containing a\n// quote or backslash could break out of the quoted literal and alter the filter.\n// Cognito defines no escaping for these, so unsafe input is rejected outright.\nexport class InvalidCognitoFilterError extends Error {\n  readonly code = 'INVALID_COGNITO_FILTER';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'InvalidCognitoFilterError';\n  }\n}\n\n// Cognito filterable attribute names: standard attributes plus prefixed ones\n// like cognito:user_status.\nconst validAttributeName = /^[a-zA-Z][a-zA-Z0-9_:]*$/;\n\n/**\n * Builds a Cognito ListUsers exact-match filter (`name = \"value\"`), rejecting\n * attribute names and values that cannot be embedded safely.\n * Throws InvalidCognitoFilterError (code INVALID_COGNITO_FILTER) on unsafe input.\n */\nexport const buildCognitoUserFilter = (attributeName: string, attributeValue: string): string => {\n  if (!validAttributeName.test(attributeName)) {\n    throw new InvalidCognitoFilterError(`Invalid Cognito filter attribute name: ${attributeName}`);\n  }\n\n  // The value is deliberately not echoed into the message: it can be user input.\n  if (attributeValue.includes('\"') || attributeValue.includes('\\\\')) {\n    throw new InvalidCognitoFilterError('Cognito filter values cannot contain quotes or backslashes');\n  }\n\n  return `${attributeName} = \"${attributeValue}\"`;\n};\n"]}

package/lib/esm/logic/cognito/utils/calculateSecretHash.d.ts

@@ -1 +1,6 @@
+/**
+ * Computes the Cognito SECRET_HASH for an app client with a secret: the base64
+ * HMAC-SHA256 of username + clientId, keyed by the client secret. Memoized
+ * because every auth call for the same user recomputes the same value.
+ */
 export declare const calculateSecretHash: (username: string, clientId: string, clientSecret: string) => string;

package/lib/esm/logic/cognito/utils/calculateSecretHash.js

@@ -1,11 +1,11 @@
 import { createHmac } from 'crypto';
 import { memoFunc } from '../../cache/memoFunc';
+/**
+ * Computes the Cognito SECRET_HASH for an app client with a secret: the base64
+ * HMAC-SHA256 of username + clientId, keyed by the client secret. Memoized
+ * because every auth call for the same user recomputes the same value.
+ */
 export const calculateSecretHash = memoFunc((username, clientId, clientSecret) => {
-    // create the hmac with the sha256 algorithm and a secret key
-    const hasher = createHmac('sha256', clientSecret);
-    // add the value we want to hash
-    hasher.update(`${username}${clientId}`);
-    // get the hashed value as base64
-    return hasher.digest('base64');
+    return createHmac('sha256', clientSecret).update(`${username}${clientId}`).digest('base64');
 });
 //# sourceMappingURL=calculateSecretHash.js.map