quidproquo-actionprocessor-awslambda 0.1.8 → 0.1.10

package/lib/commonjs/getActionProcessor/core/file/getFileGenerateTemporaryUploadSecureUrlActionProcessor.js

@@ -18,13 +18,13 @@ const utils_1 = require("./utils");
 // SigV4 presigned URLs cannot expire more than 7 days in the future
 const maxExpirationMs = 7 * 24 * 60 * 60 * 1000;
 const getProcessFileGenerateTemporaryUploadSecureUrl = (qpqConfig) => {
-    return (_a, session_1) => __awaiter(void 0, [_a, session_1], void 0, function* ({ drive, filepath, expirationMs, contentType, scope }, session) {
+    return (_a, session_1) => __awaiter(void 0, [_a, session_1], void 0, function* ({ drive, filepath, expirationMs, contentType, contentDisposition, scope }, session) {
         if (expirationMs > maxExpirationMs) {
             return (0, quidproquo_core_1.actionResultError)(quidproquo_core_2.FileGenerateTemporaryUploadSecureUrlErrorTypeEnum.ExpirationTooLong, 'Expiration exceeds the 7 day maximum for presigned URLs');
         }
         try {
             const s3BucketName = (0, utils_1.resolveStorageDriveBucketName)(drive, qpqConfig);
-            const url = yield (0, generatePresignedUploadUrl_1.generatePresignedUploadUrl)(s3BucketName, (0, quidproquo_core_2.composeScopedFilePath)(scope, filepath), quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig), expirationMs, session.correlation, contentType);
+            const url = yield (0, generatePresignedUploadUrl_1.generatePresignedUploadUrl)(s3BucketName, (0, quidproquo_core_2.composeScopedFilePath)(scope, filepath), quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig), expirationMs, session.correlation, contentType, contentDisposition);
             return (0, quidproquo_core_2.actionResult)(url);
         }
         catch (error) {

package/lib/commonjs/getActionProcessor/core/file/getFileGenerateTemporaryUploadSecureUrlActionProcessor.js.map

@@ -1 +1 @@
-{"version":3,"file":"getFileGenerateTemporaryUploadSecureUrlActionProcessor.js","sourceRoot":"","sources":["../../../../../src/getActionProcessor/core/file/getFileGenerateTemporaryUploadSecureUrlActionProcessor.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,iEAA0D;AAC1D,qDAAmJ;AACnJ,qDAMyB;AAEzB,6FAA0F;AAC1F,mCAAwD;AAExD,oEAAoE;AACpE,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD,MAAM,8CAA8C,GAAG,CAAC,SAAoB,EAAuD,EAAE;IACnI,OAAO,gBAAuE,EAAE,uDAAlE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,OAAO;QAC1E,IAAI,YAAY,GAAG,eAAe,EAAE,CAAC;YACnC,OAAO,IAAA,mCAAiB,EACtB,mEAAiD,CAAC,iBAAiB,EACnE,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAA,qCAA6B,EAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACrE,MAAM,GAAG,GAAG,MAAM,IAAA,uDAA0B,EAC1C,YAAY,EACZ,IAAA,uCAAqB,EAAC,KAAK,EAAE,QAAQ,CAAC,EACtC,yCAAiB,CAAC,gCAAgC,CAAC,SAAS,CAAC,EAC7D,YAAY,EACZ,OAAO,CAAC,WAAW,EACnB,WAAW,CACZ,CAAC;YAEF,OAAO,IAAA,8BAAY,EAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,qEAAqE;YACrE,uDAAuD;YACvD,OAAO,IAAA,kDAAgC,EAAC,KAAK,EAAE;gBAC7C,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAA,mCAAiB,EAAC,mEAAiD,CAAC,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC;aAC/H,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAA,CAAC;AACJ,CAAC,CAAC;AAEK,MAAM,sDAAsD,GAAgC,CACjG,SAAoB,EACU,EAAE;IAAC,OAAA,CAAC;QAClC,CAAC,gCAAc,CAAC,gCAAgC,CAAC,EAAE,8CAA8C,CAAC,SAAS,CAAC;KAC7G,CAAC,CAAA;EAAA,CAAC;AAJU,QAAA,sDAAsD,0DAIhE","sourcesContent":["import { qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport { ActionProcessorList, ActionProcessorListResolver, actionResultError, actionResultErrorFromCaughtError, QPQConfig } from 'quidproquo-core';\nimport {\n  actionResult,\n  composeScopedFilePath,\n  FileActionType,\n  FileGenerateTemporaryUploadSecureUrlActionProcessor,\n  FileGenerateTemporaryUploadSecureUrlErrorTypeEnum,\n} from 'quidproquo-core';\n\nimport { generatePresignedUploadUrl } from '../../../logic/s3/generatePresignedUploadUrl';\nimport { resolveStorageDriveBucketName } from './utils';\n\n// SigV4 presigned URLs cannot expire more than 7 days in the future\nconst maxExpirationMs = 7 * 24 * 60 * 60 * 1000;\n\nconst getProcessFileGenerateTemporaryUploadSecureUrl = (qpqConfig: QPQConfig): FileGenerateTemporaryUploadSecureUrlActionProcessor => {\n  return async ({ drive, filepath, expirationMs, contentType, scope }, session) => {\n    if (expirationMs > maxExpirationMs) {\n      return actionResultError(\n        FileGenerateTemporaryUploadSecureUrlErrorTypeEnum.ExpirationTooLong,\n        'Expiration exceeds the 7 day maximum for presigned URLs',\n      );\n    }\n\n    try {\n      const s3BucketName = resolveStorageDriveBucketName(drive, qpqConfig);\n      const url = await generatePresignedUploadUrl(\n        s3BucketName,\n        composeScopedFilePath(scope, filepath),\n        qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig),\n        expirationMs,\n        session.correlation,\n        contentType,\n      );\n\n      return actionResult(url);\n    } catch (error: unknown) {\n      // Name-keyed, not instanceof: under npm link / module federation the\n      // error can come from another copy of quidproquo-core.\n      return actionResultErrorFromCaughtError(error, {\n        InvalidScopeError: (error) => actionResultError(FileGenerateTemporaryUploadSecureUrlErrorTypeEnum.InvalidScope, error.message),\n      });\n    }\n  };\n};\n\nexport const getFileGenerateTemporaryUploadSecureUrlActionProcessor: ActionProcessorListResolver = async (\n  qpqConfig: QPQConfig,\n): Promise<ActionProcessorList> => ({\n  [FileActionType.GenerateTemporaryUploadSecureUrl]: getProcessFileGenerateTemporaryUploadSecureUrl(qpqConfig),\n});\n"]}
+{"version":3,"file":"getFileGenerateTemporaryUploadSecureUrlActionProcessor.js","sourceRoot":"","sources":["../../../../../src/getActionProcessor/core/file/getFileGenerateTemporaryUploadSecureUrlActionProcessor.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,iEAA0D;AAC1D,qDAAmJ;AACnJ,qDAMyB;AAEzB,6FAA0F;AAC1F,mCAAwD;AAExD,oEAAoE;AACpE,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD,MAAM,8CAA8C,GAAG,CAAC,SAAoB,EAAuD,EAAE;IACnI,OAAO,gBAA2F,EAAE,uDAAtF,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,OAAO;QAC9F,IAAI,YAAY,GAAG,eAAe,EAAE,CAAC;YACnC,OAAO,IAAA,mCAAiB,EACtB,mEAAiD,CAAC,iBAAiB,EACnE,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAA,qCAA6B,EAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACrE,MAAM,GAAG,GAAG,MAAM,IAAA,uDAA0B,EAC1C,YAAY,EACZ,IAAA,uCAAqB,EAAC,KAAK,EAAE,QAAQ,CAAC,EACtC,yCAAiB,CAAC,gCAAgC,CAAC,SAAS,CAAC,EAC7D,YAAY,EACZ,OAAO,CAAC,WAAW,EACnB,WAAW,EACX,kBAAkB,CACnB,CAAC;YAEF,OAAO,IAAA,8BAAY,EAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,qEAAqE;YACrE,uDAAuD;YACvD,OAAO,IAAA,kDAAgC,EAAC,KAAK,EAAE;gBAC7C,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAA,mCAAiB,EAAC,mEAAiD,CAAC,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC;aAC/H,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAA,CAAC;AACJ,CAAC,CAAC;AAEK,MAAM,sDAAsD,GAAgC,CACjG,SAAoB,EACU,EAAE;IAAC,OAAA,CAAC;QAClC,CAAC,gCAAc,CAAC,gCAAgC,CAAC,EAAE,8CAA8C,CAAC,SAAS,CAAC;KAC7G,CAAC,CAAA;EAAA,CAAC;AAJU,QAAA,sDAAsD,0DAIhE","sourcesContent":["import { qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport { ActionProcessorList, ActionProcessorListResolver, actionResultError, actionResultErrorFromCaughtError, QPQConfig } from 'quidproquo-core';\nimport {\n  actionResult,\n  composeScopedFilePath,\n  FileActionType,\n  FileGenerateTemporaryUploadSecureUrlActionProcessor,\n  FileGenerateTemporaryUploadSecureUrlErrorTypeEnum,\n} from 'quidproquo-core';\n\nimport { generatePresignedUploadUrl } from '../../../logic/s3/generatePresignedUploadUrl';\nimport { resolveStorageDriveBucketName } from './utils';\n\n// SigV4 presigned URLs cannot expire more than 7 days in the future\nconst maxExpirationMs = 7 * 24 * 60 * 60 * 1000;\n\nconst getProcessFileGenerateTemporaryUploadSecureUrl = (qpqConfig: QPQConfig): FileGenerateTemporaryUploadSecureUrlActionProcessor => {\n  return async ({ drive, filepath, expirationMs, contentType, contentDisposition, scope }, session) => {\n    if (expirationMs > maxExpirationMs) {\n      return actionResultError(\n        FileGenerateTemporaryUploadSecureUrlErrorTypeEnum.ExpirationTooLong,\n        'Expiration exceeds the 7 day maximum for presigned URLs',\n      );\n    }\n\n    try {\n      const s3BucketName = resolveStorageDriveBucketName(drive, qpqConfig);\n      const url = await generatePresignedUploadUrl(\n        s3BucketName,\n        composeScopedFilePath(scope, filepath),\n        qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig),\n        expirationMs,\n        session.correlation,\n        contentType,\n        contentDisposition,\n      );\n\n      return actionResult(url);\n    } catch (error: unknown) {\n      // Name-keyed, not instanceof: under npm link / module federation the\n      // error can come from another copy of quidproquo-core.\n      return actionResultErrorFromCaughtError(error, {\n        InvalidScopeError: (error) => actionResultError(FileGenerateTemporaryUploadSecureUrlErrorTypeEnum.InvalidScope, error.message),\n      });\n    }\n  };\n};\n\nexport const getFileGenerateTemporaryUploadSecureUrlActionProcessor: ActionProcessorListResolver = async (\n  qpqConfig: QPQConfig,\n): Promise<ActionProcessorList> => ({\n  [FileActionType.GenerateTemporaryUploadSecureUrl]: getProcessFileGenerateTemporaryUploadSecureUrl(qpqConfig),\n});\n"]}

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectoryRevokeRefreshTokenActionProcessor.d.ts

@@ -0,0 +1,2 @@
+import { ActionProcessorListResolver } from 'quidproquo-core';
+export declare const getUserDirectoryRevokeRefreshTokenActionProcessor: ActionProcessorListResolver;

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectoryRevokeRefreshTokenActionProcessor.js

@@ -0,0 +1,41 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getUserDirectoryRevokeRefreshTokenActionProcessor = void 0;
+const quidproquo_config_aws_1 = require("quidproquo-config-aws");
+const quidproquo_core_1 = require("quidproquo-core");
+const awsNamingUtils_1 = require("../../../awsNamingUtils");
+const getExportedValue_1 = require("../../../logic/cloudformation/getExportedValue");
+const revokeRefreshToken_1 = require("../../../logic/cognito/revokeRefreshToken");
+const getProcessRevokeRefreshToken = (qpqConfig) => {
+    return (_a) => __awaiter(void 0, [_a], void 0, function* ({ userDirectoryName, refreshToken }) {
+        const region = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
+        const userPoolId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolIdFromConfig)(userDirectoryName, qpqConfig), region);
+        const userPoolClientId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolClientIdFromConfig)(userDirectoryName, qpqConfig), region);
+        try {
+            yield (0, revokeRefreshToken_1.revokeRefreshToken)(userPoolId, userPoolClientId, region, refreshToken);
+            return (0, quidproquo_core_1.actionResult)(void 0);
+        }
+        catch (error) {
+            return (0, quidproquo_core_1.actionResultErrorFromCaughtError)(error, {
+                NotAuthorizedException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryRevokeRefreshTokenErrorTypeEnum.Unauthorized, 'Refresh token is invalid or already revoked'),
+                TooManyRequestsException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryRevokeRefreshTokenErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+            });
+        }
+    });
+};
+const getUserDirectoryRevokeRefreshTokenActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {
+    return ({
+        [quidproquo_core_1.UserDirectoryActionType.RevokeRefreshToken]: getProcessRevokeRefreshToken(qpqConfig),
+    });
+});
+exports.getUserDirectoryRevokeRefreshTokenActionProcessor = getUserDirectoryRevokeRefreshTokenActionProcessor;
+//# sourceMappingURL=getUserDirectoryRevokeRefreshTokenActionProcessor.js.map

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectoryRevokeRefreshTokenActionProcessor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getUserDirectoryRevokeRefreshTokenActionProcessor.js","sourceRoot":"","sources":["../../../../../src/getActionProcessor/core/userDirectory/getUserDirectoryRevokeRefreshTokenActionProcessor.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,iEAA0D;AAC1D,qDAUyB;AAEzB,4DAAyH;AACzH,qFAAkF;AAClF,kFAA+E;AAE/E,MAAM,4BAA4B,GAAG,CAAC,SAAoB,EAAkD,EAAE;IAC5G,OAAO,KAA4C,EAAE,4CAAvC,EAAE,iBAAiB,EAAE,YAAY,EAAE;QAC/C,MAAM,MAAM,GAAG,yCAAiB,CAAC,gCAAgC,CAAC,SAAS,CAAC,CAAC;QAE7E,MAAM,UAAU,GAAG,MAAM,IAAA,mCAAgB,EAAC,IAAA,oDAAmC,EAAC,iBAAiB,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;QAErH,MAAM,gBAAgB,GAAG,MAAM,IAAA,mCAAgB,EAAC,IAAA,0DAAyC,EAAC,iBAAiB,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;QAEjI,IAAI,CAAC;YACH,MAAM,IAAA,uCAAkB,EAAC,UAAU,EAAE,gBAAgB,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;YAE7E,OAAO,IAAA,8BAAY,EAAC,KAAK,CAAC,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,OAAO,IAAA,kDAAgC,EAAC,KAAK,EAAE;gBAC7C,sBAAsB,EAAE,GAAG,EAAE,CAC3B,IAAA,mCAAiB,EAAC,8DAA4C,CAAC,YAAY,EAAE,6CAA6C,CAAC;gBAC7H,wBAAwB,EAAE,GAAG,EAAE,CAC7B,IAAA,mCAAiB,EAAC,8DAA4C,CAAC,aAAa,EAAE,2CAA2C,CAAC;aAC7H,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAA,CAAC;AACJ,CAAC,CAAC;AAEK,MAAM,iDAAiD,GAAgC,CAC5F,SAAoB,EACU,EAAE;IAAC,OAAA,CAAC;QAClC,CAAC,yCAAuB,CAAC,kBAAkB,CAAC,EAAE,4BAA4B,CAAC,SAAS,CAAC;KACtF,CAAC,CAAA;EAAA,CAAC;AAJU,QAAA,iDAAiD,qDAI3D","sourcesContent":["import { qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport {\n  ActionProcessorList,\n  ActionProcessorListResolver,\n  actionResult,\n  actionResultError,\n  actionResultErrorFromCaughtError,\n  QPQConfig,\n  UserDirectoryActionType,\n  UserDirectoryRevokeRefreshTokenActionProcessor,\n  UserDirectoryRevokeRefreshTokenErrorTypeEnum,\n} from 'quidproquo-core';\n\nimport { getCFExportNameUserPoolClientIdFromConfig, getCFExportNameUserPoolIdFromConfig } from '../../../awsNamingUtils';\nimport { getExportedValue } from '../../../logic/cloudformation/getExportedValue';\nimport { revokeRefreshToken } from '../../../logic/cognito/revokeRefreshToken';\n\nconst getProcessRevokeRefreshToken = (qpqConfig: QPQConfig): UserDirectoryRevokeRefreshTokenActionProcessor => {\n  return async ({ userDirectoryName, refreshToken }) => {\n    const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);\n\n    const userPoolId = await getExportedValue(getCFExportNameUserPoolIdFromConfig(userDirectoryName, qpqConfig), region);\n\n    const userPoolClientId = await getExportedValue(getCFExportNameUserPoolClientIdFromConfig(userDirectoryName, qpqConfig), region);\n\n    try {\n      await revokeRefreshToken(userPoolId, userPoolClientId, region, refreshToken);\n\n      return actionResult(void 0);\n    } catch (error: unknown) {\n      return actionResultErrorFromCaughtError(error, {\n        NotAuthorizedException: () =>\n          actionResultError(UserDirectoryRevokeRefreshTokenErrorTypeEnum.Unauthorized, 'Refresh token is invalid or already revoked'),\n        TooManyRequestsException: () =>\n          actionResultError(UserDirectoryRevokeRefreshTokenErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),\n      });\n    }\n  };\n};\n\nexport const getUserDirectoryRevokeRefreshTokenActionProcessor: ActionProcessorListResolver = async (\n  qpqConfig: QPQConfig,\n): Promise<ActionProcessorList> => ({\n  [UserDirectoryActionType.RevokeRefreshToken]: getProcessRevokeRefreshToken(qpqConfig),\n});\n"]}

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectorySignOutUserActionProcessor.d.ts

@@ -0,0 +1,2 @@
+import { ActionProcessorListResolver } from 'quidproquo-core';
+export declare const getUserDirectorySignOutUserActionProcessor: ActionProcessorListResolver;

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectorySignOutUserActionProcessor.js

@@ -0,0 +1,37 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getUserDirectorySignOutUserActionProcessor = void 0;
+const quidproquo_config_aws_1 = require("quidproquo-config-aws");
+const quidproquo_core_1 = require("quidproquo-core");
+const globalSignOut_1 = require("../../../logic/cognito/globalSignOut");
+const getProcessSignOutUser = (qpqConfig) => {
+    return (_a) => __awaiter(void 0, [_a], void 0, function* ({ accessToken }) {
+        const region = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
+        try {
+            yield (0, globalSignOut_1.globalSignOut)(accessToken, region);
+            return (0, quidproquo_core_1.actionResult)(void 0);
+        }
+        catch (error) {
+            return (0, quidproquo_core_1.actionResultErrorFromCaughtError)(error, {
+                NotAuthorizedException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectorySignOutUserErrorTypeEnum.Unauthorized, 'Access token is invalid or has expired'),
+                TooManyRequestsException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectorySignOutUserErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+            });
+        }
+    });
+};
+const getUserDirectorySignOutUserActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {
+    return ({
+        [quidproquo_core_1.UserDirectoryActionType.SignOutUser]: getProcessSignOutUser(qpqConfig),
+    });
+});
+exports.getUserDirectorySignOutUserActionProcessor = getUserDirectorySignOutUserActionProcessor;
+//# sourceMappingURL=getUserDirectorySignOutUserActionProcessor.js.map

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectorySignOutUserActionProcessor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getUserDirectorySignOutUserActionProcessor.js","sourceRoot":"","sources":["../../../../../src/getActionProcessor/core/userDirectory/getUserDirectorySignOutUserActionProcessor.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,iEAA0D;AAC1D,qDAUyB;AAEzB,wEAAqE;AAErE,MAAM,qBAAqB,GAAG,CAAC,SAAoB,EAA2C,EAAE;IAC9F,OAAO,KAAwB,EAAE,4CAAnB,EAAE,WAAW,EAAE;QAC3B,MAAM,MAAM,GAAG,yCAAiB,CAAC,gCAAgC,CAAC,SAAS,CAAC,CAAC;QAE7E,IAAI,CAAC;YACH,MAAM,IAAA,6BAAa,EAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAEzC,OAAO,IAAA,8BAAY,EAAC,KAAK,CAAC,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,OAAO,IAAA,kDAAgC,EAAC,KAAK,EAAE;gBAC7C,sBAAsB,EAAE,GAAG,EAAE,CAAC,IAAA,mCAAiB,EAAC,uDAAqC,CAAC,YAAY,EAAE,wCAAwC,CAAC;gBAC7I,wBAAwB,EAAE,GAAG,EAAE,CAC7B,IAAA,mCAAiB,EAAC,uDAAqC,CAAC,aAAa,EAAE,2CAA2C,CAAC;aACtH,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAA,CAAC;AACJ,CAAC,CAAC;AAEK,MAAM,0CAA0C,GAAgC,CACrF,SAAoB,EACU,EAAE;IAAC,OAAA,CAAC;QAClC,CAAC,yCAAuB,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC,SAAS,CAAC;KACxE,CAAC,CAAA;EAAA,CAAC;AAJU,QAAA,0CAA0C,8CAIpD","sourcesContent":["import { qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport {\n  ActionProcessorList,\n  ActionProcessorListResolver,\n  actionResult,\n  actionResultError,\n  actionResultErrorFromCaughtError,\n  QPQConfig,\n  UserDirectoryActionType,\n  UserDirectorySignOutUserActionProcessor,\n  UserDirectorySignOutUserErrorTypeEnum,\n} from 'quidproquo-core';\n\nimport { globalSignOut } from '../../../logic/cognito/globalSignOut';\n\nconst getProcessSignOutUser = (qpqConfig: QPQConfig): UserDirectorySignOutUserActionProcessor => {\n  return async ({ accessToken }) => {\n    const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);\n\n    try {\n      await globalSignOut(accessToken, region);\n\n      return actionResult(void 0);\n    } catch (error: unknown) {\n      return actionResultErrorFromCaughtError(error, {\n        NotAuthorizedException: () => actionResultError(UserDirectorySignOutUserErrorTypeEnum.Unauthorized, 'Access token is invalid or has expired'),\n        TooManyRequestsException: () =>\n          actionResultError(UserDirectorySignOutUserErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),\n      });\n    }\n  };\n};\n\nexport const getUserDirectorySignOutUserActionProcessor: ActionProcessorListResolver = async (\n  qpqConfig: QPQConfig,\n): Promise<ActionProcessorList> => ({\n  [UserDirectoryActionType.SignOutUser]: getProcessSignOutUser(qpqConfig),\n});\n"]}

package/lib/commonjs/getActionProcessor/core/userDirectory/index.js

@@ -26,11 +26,13 @@ const getUserDirectoryReadAccessTokenActionProcessor_1 = require("./getUserDirec
 const getUserDirectoryRefreshTokenActionProcessor_1 = require("./getUserDirectoryRefreshTokenActionProcessor");
 const getUserDirectoryRequestEmailVerificationActionProcessor_1 = require("./getUserDirectoryRequestEmailVerificationActionProcessor");
 const getUserDirectoryRespondToAuthChallengeActionProcessor_1 = require("./getUserDirectoryRespondToAuthChallengeActionProcessor");
+const getUserDirectoryRevokeRefreshTokenActionProcessor_1 = require("./getUserDirectoryRevokeRefreshTokenActionProcessor");
 const getUserDirectorySetAccessTokenActionProcessor_1 = require("./getUserDirectorySetAccessTokenActionProcessor");
 const getUserDirectorySetPasswordActionProcessor_1 = require("./getUserDirectorySetPasswordActionProcessor");
 const getUserDirectorySetUserAttributesActionProcessor_1 = require("./getUserDirectorySetUserAttributesActionProcessor");
+const getUserDirectorySignOutUserActionProcessor_1 = require("./getUserDirectorySignOutUserActionProcessor");
 const getUserDirectoryActionProcessor = (qpqConfig, dynamicModuleLoader) => __awaiter(void 0, void 0, void 0, function* () {
-    return (Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (yield (0, getUserDirectoryAssociateSoftwareTokenActionProcessor_1.getUserDirectoryAssociateSoftwareTokenActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryAuthenticateUserActionProcessor_1.getUserDirectoryAuthenticateUserActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryChangePasswordActionProcessor_1.getUserDirectoryChangePasswordActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryConfirmEmailVerificationActionProcessor_1.getUserDirectoryConfirmEmailVerificationActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryConfirmForgotPasswordActionProcessor_1.getUserDirectoryConfirmForgotPasswordActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryCreateUserActionProcessor_1.getUserDirectoryCreateUserActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryDecodeAccessTokenActionProcessor_1.getUserDirectoryDecodeAccessTokenActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryForgotPasswordActionProcessor_1.getUserDirectoryForgotPasswordActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryGetUserAttributesActionProcessor_1.getUserDirectoryGetUserAttributesActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryGetUserAttributesByUserIdActionProcessor_1.getUserDirectoryGetUserAttributesByUserIdActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryGetUsersActionProcessor_1.getUserDirectoryGetUsersActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryGetUsersByAttributeActionProcessor_1.getUserDirectoryGetUsersByAttributeActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryReadAccessTokenActionProcessor_1.getUserDirectoryReadAccessTokenActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryRefreshTokenActionProcessor_1.getUserDirectoryRefreshTokenActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryRequestEmailVerificationActionProcessor_1.getUserDirectoryRequestEmailVerificationActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryRespondToAuthChallengeActionProcessor_1.getUserDirectoryRespondToAuthChallengeActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectorySetAccessTokenActionProcessor_1.getUserDirectorySetAccessTokenActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectorySetPasswordActionProcessor_1.getUserDirectorySetPasswordActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectorySetUserAttributesActionProcessor_1.getUserDirectorySetUserAttributesActionProcessor)(qpqConfig, dynamicModuleLoader))));
+    return (Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (yield (0, getUserDirectoryAssociateSoftwareTokenActionProcessor_1.getUserDirectoryAssociateSoftwareTokenActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryAuthenticateUserActionProcessor_1.getUserDirectoryAuthenticateUserActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryChangePasswordActionProcessor_1.getUserDirectoryChangePasswordActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryConfirmEmailVerificationActionProcessor_1.getUserDirectoryConfirmEmailVerificationActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryConfirmForgotPasswordActionProcessor_1.getUserDirectoryConfirmForgotPasswordActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryCreateUserActionProcessor_1.getUserDirectoryCreateUserActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryDecodeAccessTokenActionProcessor_1.getUserDirectoryDecodeAccessTokenActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryForgotPasswordActionProcessor_1.getUserDirectoryForgotPasswordActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryGetUserAttributesActionProcessor_1.getUserDirectoryGetUserAttributesActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryGetUserAttributesByUserIdActionProcessor_1.getUserDirectoryGetUserAttributesByUserIdActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryGetUsersActionProcessor_1.getUserDirectoryGetUsersActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryGetUsersByAttributeActionProcessor_1.getUserDirectoryGetUsersByAttributeActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryReadAccessTokenActionProcessor_1.getUserDirectoryReadAccessTokenActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryRefreshTokenActionProcessor_1.getUserDirectoryRefreshTokenActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryRevokeRefreshTokenActionProcessor_1.getUserDirectoryRevokeRefreshTokenActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryRequestEmailVerificationActionProcessor_1.getUserDirectoryRequestEmailVerificationActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryRespondToAuthChallengeActionProcessor_1.getUserDirectoryRespondToAuthChallengeActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectorySetAccessTokenActionProcessor_1.getUserDirectorySetAccessTokenActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectorySetPasswordActionProcessor_1.getUserDirectorySetPasswordActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectorySetUserAttributesActionProcessor_1.getUserDirectorySetUserAttributesActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectorySignOutUserActionProcessor_1.getUserDirectorySignOutUserActionProcessor)(qpqConfig, dynamicModuleLoader))));
 });
 exports.getUserDirectoryActionProcessor = getUserDirectoryActionProcessor;
 //# sourceMappingURL=index.js.map

package/lib/commonjs/getActionProcessor/core/userDirectory/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/getActionProcessor/core/userDirectory/index.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,mIAAgI;AAChI,uHAAoH;AACpH,mHAAgH;AAChH,uIAAoI;AACpI,iIAA8H;AAC9H,2GAAwG;AACxG,yHAAsH;AACtH,mHAAgH;AAChH,yHAAsH;AACtH,yIAAsI;AACtI,uGAAoG;AACpG,6HAA0H;AAC1H,qHAAkH;AAClH,+GAA4G;AAC5G,uIAAoI;AACpI,mIAAgI;AAChI,mHAAgH;AAChH,6GAA0G;AAC1G,yHAAsH;AAE/G,MAAM,+BAA+B,GAAgC,CAC1E,SAAoB,EACpB,mBAAwC,EACV,EAAE;IAAC,OAAA,+QAC9B,CAAC,MAAM,IAAA,6GAAqD,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAC7F,CAAC,MAAM,IAAA,iGAA+C,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACvF,CAAC,MAAM,IAAA,6FAA6C,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACrF,CAAC,MAAM,IAAA,iHAAuD,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAC/F,CAAC,MAAM,IAAA,2GAAoD,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAC5F,CAAC,MAAM,IAAA,qFAAyC,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACjF,CAAC,MAAM,IAAA,mGAAgD,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACxF,CAAC,MAAM,IAAA,6FAA6C,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACrF,CAAC,MAAM,IAAA,mGAAgD,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACxF,CAAC,MAAM,IAAA,mHAAwD,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAChG,CAAC,MAAM,IAAA,iFAAuC,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAC/E,CAAC,MAAM,IAAA,uGAAkD,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAC1F,CAAC,MAAM,IAAA,+FAA8C,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACtF,CAAC,MAAM,IAAA,yFAA2C,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACnF,CAAC,MAAM,IAAA,iHAAuD,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAC/F,CAAC,MAAM,IAAA,6GAAqD,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAC7F,CAAC,MAAM,IAAA,6FAA6C,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACrF,CAAC,MAAM,IAAA,uFAA0C,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAClF,CAAC,MAAM,IAAA,mGAAgD,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,EAC3F,CAAA;EAAA,CAAC;AAvBU,QAAA,+BAA+B,mCAuBzC","sourcesContent":["import { ActionProcessorList, ActionProcessorListResolver, DynamicModuleLoader, QPQConfig } from 'quidproquo-core';\n\nimport { getUserDirectoryAssociateSoftwareTokenActionProcessor } from './getUserDirectoryAssociateSoftwareTokenActionProcessor';\nimport { getUserDirectoryAuthenticateUserActionProcessor } from './getUserDirectoryAuthenticateUserActionProcessor';\nimport { getUserDirectoryChangePasswordActionProcessor } from './getUserDirectoryChangePasswordActionProcessor';\nimport { getUserDirectoryConfirmEmailVerificationActionProcessor } from './getUserDirectoryConfirmEmailVerificationActionProcessor';\nimport { getUserDirectoryConfirmForgotPasswordActionProcessor } from './getUserDirectoryConfirmForgotPasswordActionProcessor';\nimport { getUserDirectoryCreateUserActionProcessor } from './getUserDirectoryCreateUserActionProcessor';\nimport { getUserDirectoryDecodeAccessTokenActionProcessor } from './getUserDirectoryDecodeAccessTokenActionProcessor';\nimport { getUserDirectoryForgotPasswordActionProcessor } from './getUserDirectoryForgotPasswordActionProcessor';\nimport { getUserDirectoryGetUserAttributesActionProcessor } from './getUserDirectoryGetUserAttributesActionProcessor';\nimport { getUserDirectoryGetUserAttributesByUserIdActionProcessor } from './getUserDirectoryGetUserAttributesByUserIdActionProcessor';\nimport { getUserDirectoryGetUsersActionProcessor } from './getUserDirectoryGetUsersActionProcessor';\nimport { getUserDirectoryGetUsersByAttributeActionProcessor } from './getUserDirectoryGetUsersByAttributeActionProcessor';\nimport { getUserDirectoryReadAccessTokenActionProcessor } from './getUserDirectoryReadAccessTokenActionProcessor';\nimport { getUserDirectoryRefreshTokenActionProcessor } from './getUserDirectoryRefreshTokenActionProcessor';\nimport { getUserDirectoryRequestEmailVerificationActionProcessor } from './getUserDirectoryRequestEmailVerificationActionProcessor';\nimport { getUserDirectoryRespondToAuthChallengeActionProcessor } from './getUserDirectoryRespondToAuthChallengeActionProcessor';\nimport { getUserDirectorySetAccessTokenActionProcessor } from './getUserDirectorySetAccessTokenActionProcessor';\nimport { getUserDirectorySetPasswordActionProcessor } from './getUserDirectorySetPasswordActionProcessor';\nimport { getUserDirectorySetUserAttributesActionProcessor } from './getUserDirectorySetUserAttributesActionProcessor';\n\nexport const getUserDirectoryActionProcessor: ActionProcessorListResolver = async (\n  qpqConfig: QPQConfig,\n  dynamicModuleLoader: DynamicModuleLoader,\n): Promise<ActionProcessorList> => ({\n  ...(await getUserDirectoryAssociateSoftwareTokenActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryAuthenticateUserActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryChangePasswordActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryConfirmEmailVerificationActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryConfirmForgotPasswordActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryCreateUserActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryDecodeAccessTokenActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryForgotPasswordActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryGetUserAttributesActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryGetUserAttributesByUserIdActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryGetUsersActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryGetUsersByAttributeActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryReadAccessTokenActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryRefreshTokenActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryRequestEmailVerificationActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryRespondToAuthChallengeActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectorySetAccessTokenActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectorySetPasswordActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectorySetUserAttributesActionProcessor(qpqConfig, dynamicModuleLoader)),\n});\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/getActionProcessor/core/userDirectory/index.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,mIAAgI;AAChI,uHAAoH;AACpH,mHAAgH;AAChH,uIAAoI;AACpI,iIAA8H;AAC9H,2GAAwG;AACxG,yHAAsH;AACtH,mHAAgH;AAChH,yHAAsH;AACtH,yIAAsI;AACtI,uGAAoG;AACpG,6HAA0H;AAC1H,qHAAkH;AAClH,+GAA4G;AAC5G,uIAAoI;AACpI,mIAAgI;AAChI,2HAAwH;AACxH,mHAAgH;AAChH,6GAA0G;AAC1G,yHAAsH;AACtH,6GAA0G;AAEnG,MAAM,+BAA+B,GAAgC,CAC1E,SAAoB,EACpB,mBAAwC,EACV,EAAE;IAAC,OAAA,2SAC9B,CAAC,MAAM,IAAA,6GAAqD,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAC7F,CAAC,MAAM,IAAA,iGAA+C,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACvF,CAAC,MAAM,IAAA,6FAA6C,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACrF,CAAC,MAAM,IAAA,iHAAuD,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAC/F,CAAC,MAAM,IAAA,2GAAoD,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAC5F,CAAC,MAAM,IAAA,qFAAyC,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACjF,CAAC,MAAM,IAAA,mGAAgD,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACxF,CAAC,MAAM,IAAA,6FAA6C,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACrF,CAAC,MAAM,IAAA,mGAAgD,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACxF,CAAC,MAAM,IAAA,mHAAwD,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAChG,CAAC,MAAM,IAAA,iFAAuC,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAC/E,CAAC,MAAM,IAAA,uGAAkD,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAC1F,CAAC,MAAM,IAAA,+FAA8C,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACtF,CAAC,MAAM,IAAA,yFAA2C,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACnF,CAAC,MAAM,IAAA,qGAAiD,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACzF,CAAC,MAAM,IAAA,iHAAuD,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAC/F,CAAC,MAAM,IAAA,6GAAqD,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAC7F,CAAC,MAAM,IAAA,6FAA6C,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACrF,CAAC,MAAM,IAAA,uFAA0C,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAClF,CAAC,MAAM,IAAA,mGAAgD,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACxF,CAAC,MAAM,IAAA,uFAA0C,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,EACrF,CAAA;EAAA,CAAC;AAzBU,QAAA,+BAA+B,mCAyBzC","sourcesContent":["import { ActionProcessorList, ActionProcessorListResolver, DynamicModuleLoader, QPQConfig } from 'quidproquo-core';\n\nimport { getUserDirectoryAssociateSoftwareTokenActionProcessor } from './getUserDirectoryAssociateSoftwareTokenActionProcessor';\nimport { getUserDirectoryAuthenticateUserActionProcessor } from './getUserDirectoryAuthenticateUserActionProcessor';\nimport { getUserDirectoryChangePasswordActionProcessor } from './getUserDirectoryChangePasswordActionProcessor';\nimport { getUserDirectoryConfirmEmailVerificationActionProcessor } from './getUserDirectoryConfirmEmailVerificationActionProcessor';\nimport { getUserDirectoryConfirmForgotPasswordActionProcessor } from './getUserDirectoryConfirmForgotPasswordActionProcessor';\nimport { getUserDirectoryCreateUserActionProcessor } from './getUserDirectoryCreateUserActionProcessor';\nimport { getUserDirectoryDecodeAccessTokenActionProcessor } from './getUserDirectoryDecodeAccessTokenActionProcessor';\nimport { getUserDirectoryForgotPasswordActionProcessor } from './getUserDirectoryForgotPasswordActionProcessor';\nimport { getUserDirectoryGetUserAttributesActionProcessor } from './getUserDirectoryGetUserAttributesActionProcessor';\nimport { getUserDirectoryGetUserAttributesByUserIdActionProcessor } from './getUserDirectoryGetUserAttributesByUserIdActionProcessor';\nimport { getUserDirectoryGetUsersActionProcessor } from './getUserDirectoryGetUsersActionProcessor';\nimport { getUserDirectoryGetUsersByAttributeActionProcessor } from './getUserDirectoryGetUsersByAttributeActionProcessor';\nimport { getUserDirectoryReadAccessTokenActionProcessor } from './getUserDirectoryReadAccessTokenActionProcessor';\nimport { getUserDirectoryRefreshTokenActionProcessor } from './getUserDirectoryRefreshTokenActionProcessor';\nimport { getUserDirectoryRequestEmailVerificationActionProcessor } from './getUserDirectoryRequestEmailVerificationActionProcessor';\nimport { getUserDirectoryRespondToAuthChallengeActionProcessor } from './getUserDirectoryRespondToAuthChallengeActionProcessor';\nimport { getUserDirectoryRevokeRefreshTokenActionProcessor } from './getUserDirectoryRevokeRefreshTokenActionProcessor';\nimport { getUserDirectorySetAccessTokenActionProcessor } from './getUserDirectorySetAccessTokenActionProcessor';\nimport { getUserDirectorySetPasswordActionProcessor } from './getUserDirectorySetPasswordActionProcessor';\nimport { getUserDirectorySetUserAttributesActionProcessor } from './getUserDirectorySetUserAttributesActionProcessor';\nimport { getUserDirectorySignOutUserActionProcessor } from './getUserDirectorySignOutUserActionProcessor';\n\nexport const getUserDirectoryActionProcessor: ActionProcessorListResolver = async (\n  qpqConfig: QPQConfig,\n  dynamicModuleLoader: DynamicModuleLoader,\n): Promise<ActionProcessorList> => ({\n  ...(await getUserDirectoryAssociateSoftwareTokenActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryAuthenticateUserActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryChangePasswordActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryConfirmEmailVerificationActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryConfirmForgotPasswordActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryCreateUserActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryDecodeAccessTokenActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryForgotPasswordActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryGetUserAttributesActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryGetUserAttributesByUserIdActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryGetUsersActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryGetUsersByAttributeActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryReadAccessTokenActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryRefreshTokenActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryRevokeRefreshTokenActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryRequestEmailVerificationActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryRespondToAuthChallengeActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectorySetAccessTokenActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectorySetPasswordActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectorySetUserAttributesActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectorySignOutUserActionProcessor(qpqConfig, dynamicModuleLoader)),\n});\n"]}

package/lib/commonjs/logic/cognito/globalSignOut.d.ts

@@ -0,0 +1 @@
+export declare const globalSignOut: (accessToken: string, region: string) => Promise<void>;

package/lib/commonjs/logic/cognito/globalSignOut.js

@@ -0,0 +1,28 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.globalSignOut = void 0;
+const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
+const createAwsClient_1 = require("../createAwsClient");
+// Revokes EVERY refresh token issued to the user who owns this access token. Authorized by
+// the access token itself (no IAM needed, like ChangePassword). Access tokens already minted
+// stay valid until they expire (stateless JWTs), so keep the access-token validity short.
+const globalSignOut = (accessToken, region) => __awaiter(void 0, void 0, void 0, function* () {
+    const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
+        region,
+    });
+    const params = {
+        AccessToken: accessToken,
+    };
+    yield cognitoClient.send(new client_cognito_identity_provider_1.GlobalSignOutCommand(params));
+});
+exports.globalSignOut = globalSignOut;
+//# sourceMappingURL=globalSignOut.js.map

package/lib/commonjs/logic/cognito/globalSignOut.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"globalSignOut.js","sourceRoot":"","sources":["../../../../src/logic/cognito/globalSignOut.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gGAA2I;AAE3I,wDAAqD;AAErD,2FAA2F;AAC3F,6FAA6F;AAC7F,0FAA0F;AACnF,MAAM,aAAa,GAAG,CAAO,WAAmB,EAAE,MAAc,EAAiB,EAAE;IACxF,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAA8B;QACxC,WAAW,EAAE,WAAW;KACzB,CAAC;IAEF,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,uDAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7D,CAAC,CAAA,CAAC;AAVW,QAAA,aAAa,iBAUxB","sourcesContent":["import { CognitoIdentityProviderClient, GlobalSignOutCommand, GlobalSignOutCommandInput } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\n\n// Revokes EVERY refresh token issued to the user who owns this access token. Authorized by\n// the access token itself (no IAM needed, like ChangePassword). Access tokens already minted\n// stay valid until they expire (stateless JWTs), so keep the access-token validity short.\nexport const globalSignOut = async (accessToken: string, region: string): Promise<void> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params: GlobalSignOutCommandInput = {\n    AccessToken: accessToken,\n  };\n\n  await cognitoClient.send(new GlobalSignOutCommand(params));\n};\n"]}

package/lib/commonjs/logic/cognito/index.d.ts

@@ -1,2 +1,4 @@
 export * from './decodeAccessToken';
 export * from './decodeValidJwt';
+export * from './globalSignOut';
+export * from './revokeRefreshToken';

package/lib/commonjs/logic/cognito/index.js

@@ -16,4 +16,6 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./decodeAccessToken"), exports);
 __exportStar(require("./decodeValidJwt"), exports);
+__exportStar(require("./globalSignOut"), exports);
+__exportStar(require("./revokeRefreshToken"), exports);
 //# sourceMappingURL=index.js.map

package/lib/commonjs/logic/cognito/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/logic/cognito/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAoC;AACpC,mDAAiC","sourcesContent":["export * from './decodeAccessToken';\nexport * from './decodeValidJwt';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/logic/cognito/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAoC;AACpC,mDAAiC;AACjC,kDAAgC;AAChC,uDAAqC","sourcesContent":["export * from './decodeAccessToken';\nexport * from './decodeValidJwt';\nexport * from './globalSignOut';\nexport * from './revokeRefreshToken';\n"]}

package/lib/commonjs/logic/cognito/refreshToken.js

@@ -33,7 +33,16 @@ const refreshToken = (userPoolId, clientId, region, username, refreshToken) => _
     // Time we issued the request
     const issueDateTime = new Date().toISOString();
     const response = yield cognitoClient.send(new client_cognito_identity_provider_1.AdminInitiateAuthCommand(params));
-    return (0, transformCognitoResponse_1.cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo)(response, issueDateTime);
+    const authResponse = (0, transformCognitoResponse_1.cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo)(response, issueDateTime);
+    // Cognito's REFRESH_TOKEN_AUTH flow does NOT return a refresh token — the existing one stays
+    // valid and is reused — so AuthenticationResult.RefreshToken is undefined here. Carry the
+    // caller's refresh token forward so the client keeps a usable session; without this it's
+    // dropped after the first refresh and the session can never refresh again. (If refresh-token
+    // rotation is ever enabled, Cognito DOES return a new one — then we keep that instead.)
+    if (authResponse.authenticationInfo && !authResponse.authenticationInfo.refreshToken) {
+        authResponse.authenticationInfo.refreshToken = refreshToken;
+    }
+    return authResponse;
 });
 exports.refreshToken = refreshToken;
 //# sourceMappingURL=refreshToken.js.map

package/lib/commonjs/logic/cognito/refreshToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"refreshToken.js","sourceRoot":"","sources":["../../../../src/logic/cognito/refreshToken.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAKmD;AAEnD,wDAAqD;AACrD,qEAAkE;AAClE,+EAA2G;AAC3G,uEAAoE;AAE7D,MAAM,YAAY,GAAG,CAC1B,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,QAAgB,EAChB,YAAoB,EACe,EAAE;IACrC,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,IAAA,iDAAuB,EAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,IAAA,yCAAmB,EAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAkC;QAC5C,QAAQ,EAAE,+CAAY,CAAC,kBAAkB;QACzC,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAElB,cAAc,EAAE;YACd,aAAa,EAAE,YAAY;YAC3B,WAAW,EAAE,UAAU;SACxB;KACF,CAAC;IAEF,6BAA6B;IAC7B,MAAM,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,2DAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhF,OAAO,IAAA,kFAAuD,EAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AAC1F,CAAC,CAAA,CAAC;AA9BW,QAAA,YAAY,gBA8BvB","sourcesContent":["import { AuthenticateUserResponse } from 'quidproquo-core';\n\nimport {\n  AdminInitiateAuthCommand,\n  AdminInitiateAuthCommandInput,\n  AuthFlowType,\n  CognitoIdentityProviderClient,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo } from './utils/transformCognitoResponse';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\nexport const refreshToken = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  username: string,\n  refreshToken: string,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  const params: AdminInitiateAuthCommandInput = {\n    AuthFlow: AuthFlowType.REFRESH_TOKEN_AUTH,\n    UserPoolId: userPoolId,\n    ClientId: clientId,\n\n    AuthParameters: {\n      REFRESH_TOKEN: refreshToken,\n      SECRET_HASH: secretHash,\n    },\n  };\n\n  // Time we issued the request\n  const issueDateTime = new Date().toISOString();\n  const response = await cognitoClient.send(new AdminInitiateAuthCommand(params));\n\n  return cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo(response, issueDateTime);\n};\n"]}
+{"version":3,"file":"refreshToken.js","sourceRoot":"","sources":["../../../../src/logic/cognito/refreshToken.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,gGAKmD;AAEnD,wDAAqD;AACrD,qEAAkE;AAClE,+EAA2G;AAC3G,uEAAoE;AAE7D,MAAM,YAAY,GAAG,CAC1B,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,QAAgB,EAChB,YAAoB,EACe,EAAE;IACrC,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,IAAA,iDAAuB,EAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,IAAA,yCAAmB,EAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAkC;QAC5C,QAAQ,EAAE,+CAAY,CAAC,kBAAkB;QACzC,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAElB,cAAc,EAAE;YACd,aAAa,EAAE,YAAY;YAC3B,WAAW,EAAE,UAAU;SACxB;KACF,CAAC;IAEF,6BAA6B;IAC7B,MAAM,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,2DAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhF,MAAM,YAAY,GAAG,IAAA,kFAAuD,EAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAEtG,6FAA6F;IAC7F,0FAA0F;IAC1F,yFAAyF;IACzF,6FAA6F;IAC7F,wFAAwF;IACxF,IAAI,YAAY,CAAC,kBAAkB,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,YAAY,EAAE,CAAC;QACrF,YAAY,CAAC,kBAAkB,CAAC,YAAY,GAAG,YAAY,CAAC;IAC9D,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC,CAAA,CAAC;AAzCW,QAAA,YAAY,gBAyCvB","sourcesContent":["import { AuthenticateUserResponse } from 'quidproquo-core';\n\nimport {\n  AdminInitiateAuthCommand,\n  AdminInitiateAuthCommandInput,\n  AuthFlowType,\n  CognitoIdentityProviderClient,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo } from './utils/transformCognitoResponse';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\nexport const refreshToken = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  username: string,\n  refreshToken: string,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  const params: AdminInitiateAuthCommandInput = {\n    AuthFlow: AuthFlowType.REFRESH_TOKEN_AUTH,\n    UserPoolId: userPoolId,\n    ClientId: clientId,\n\n    AuthParameters: {\n      REFRESH_TOKEN: refreshToken,\n      SECRET_HASH: secretHash,\n    },\n  };\n\n  // Time we issued the request\n  const issueDateTime = new Date().toISOString();\n  const response = await cognitoClient.send(new AdminInitiateAuthCommand(params));\n\n  const authResponse = cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo(response, issueDateTime);\n\n  // Cognito's REFRESH_TOKEN_AUTH flow does NOT return a refresh token — the existing one stays\n  // valid and is reused — so AuthenticationResult.RefreshToken is undefined here. Carry the\n  // caller's refresh token forward so the client keeps a usable session; without this it's\n  // dropped after the first refresh and the session can never refresh again. (If refresh-token\n  // rotation is ever enabled, Cognito DOES return a new one — then we keep that instead.)\n  if (authResponse.authenticationInfo && !authResponse.authenticationInfo.refreshToken) {\n    authResponse.authenticationInfo.refreshToken = refreshToken;\n  }\n\n  return authResponse;\n};\n"]}

package/lib/commonjs/logic/cognito/revokeRefreshToken.d.ts

@@ -0,0 +1 @@
+export declare const revokeRefreshToken: (userPoolId: string, clientId: string, region: string, refreshToken: string) => Promise<void>;

package/lib/commonjs/logic/cognito/revokeRefreshToken.js

@@ -0,0 +1,33 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.revokeRefreshToken = void 0;
+const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
+const createAwsClient_1 = require("../createAwsClient");
+const getUserPoolClientSecret_1 = require("./getUserPoolClientSecret");
+// Revokes a single refresh token (and its access-token lineage) via Cognito RevokeToken.
+// The app client has a secret (same one the refresh flow uses), so it must be supplied.
+// Requires token revocation to be enabled on the app client (the CDK default) — a disabled
+// client surfaces as UnsupportedOperationException/UnsupportedTokenTypeException.
+const revokeRefreshToken = (userPoolId, clientId, region, refreshToken) => __awaiter(void 0, void 0, void 0, function* () {
+    const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
+        region,
+    });
+    const clientSecret = yield (0, getUserPoolClientSecret_1.getUserPoolClientSecret)(userPoolId, clientId, region);
+    const params = {
+        Token: refreshToken,
+        ClientId: clientId,
+        ClientSecret: clientSecret,
+    };
+    yield cognitoClient.send(new client_cognito_identity_provider_1.RevokeTokenCommand(params));
+});
+exports.revokeRefreshToken = revokeRefreshToken;
+//# sourceMappingURL=revokeRefreshToken.js.map

package/lib/commonjs/logic/cognito/revokeRefreshToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revokeRefreshToken.js","sourceRoot":"","sources":["../../../../src/logic/cognito/revokeRefreshToken.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gGAAuI;AAEvI,wDAAqD;AACrD,uEAAoE;AAEpE,yFAAyF;AACzF,wFAAwF;AACxF,2FAA2F;AAC3F,kFAAkF;AAC3E,MAAM,kBAAkB,GAAG,CAAO,UAAkB,EAAE,QAAgB,EAAE,MAAc,EAAE,YAAoB,EAAiB,EAAE;IACpI,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,gEAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,IAAA,iDAAuB,EAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAEjF,MAAM,MAAM,GAA4B;QACtC,KAAK,EAAE,YAAY;QACnB,QAAQ,EAAE,QAAQ;QAClB,YAAY,EAAE,YAAY;KAC3B,CAAC;IAEF,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,qDAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3D,CAAC,CAAA,CAAC;AAdW,QAAA,kBAAkB,sBAc7B","sourcesContent":["import { CognitoIdentityProviderClient, RevokeTokenCommand, RevokeTokenCommandInput } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\n// Revokes a single refresh token (and its access-token lineage) via Cognito RevokeToken.\n// The app client has a secret (same one the refresh flow uses), so it must be supplied.\n// Requires token revocation to be enabled on the app client (the CDK default) — a disabled\n// client surfaces as UnsupportedOperationException/UnsupportedTokenTypeException.\nexport const revokeRefreshToken = async (userPoolId: string, clientId: string, region: string, refreshToken: string): Promise<void> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n\n  const params: RevokeTokenCommandInput = {\n    Token: refreshToken,\n    ClientId: clientId,\n    ClientSecret: clientSecret,\n  };\n\n  await cognitoClient.send(new RevokeTokenCommand(params));\n};\n"]}

package/lib/commonjs/logic/s3/generatePresignedUploadUrl.d.ts

@@ -1 +1 @@
-export declare const generatePresignedUploadUrl: (bucketName: string, objectKey: string, region: string, expirationMs: number, correlationId?: string, contentType?: string) => Promise<string>;
+export declare const generatePresignedUploadUrl: (bucketName: string, objectKey: string, region: string, expirationMs: number, correlationId?: string, contentType?: string, contentDisposition?: string) => Promise<string>;

package/lib/commonjs/logic/s3/generatePresignedUploadUrl.js

@@ -43,7 +43,7 @@ const createAwsClient_1 = require("../createAwsClient");
 //     fields: presignedPost.fields
 //   };
 // };
-const generatePresignedUploadUrl = (bucketName, objectKey, region, expirationMs, correlationId, contentType) => __awaiter(void 0, void 0, void 0, function* () {
+const generatePresignedUploadUrl = (bucketName, objectKey, region, expirationMs, correlationId, contentType, contentDisposition) => __awaiter(void 0, void 0, void 0, function* () {
     // WHEN_REQUIRED disables the SDK v3 default request checksum (CRC32). Otherwise the
     // presigner bakes an empty-body checksum (x-amz-checksum-crc32=AAAAAA==) into the signed
     // URL, which never matches the real body the browser PUTs — S3 then rejects the upload and
@@ -56,6 +56,9 @@ const generatePresignedUploadUrl = (bucketName, objectKey, region, expirationMs,
         Bucket: bucketName,
         Key: objectKey,
         ContentType: contentType,
+        // Signed into the URL: the client's PUT must send the matching Content-Disposition header, and
+        // S3 stores it so later GETs serve it back (e.g. 'inline' to preview a PDF instead of downloading).
+        ContentDisposition: contentDisposition,
         Metadata: Object.assign(Object.assign({}, (correlationId && { 'correlation-id': correlationId })), { 'upload-timestamp': Date.now().toString() }),
     });
     const url = yield (0, s3_request_presigner_1.getSignedUrl)(s3Client, putObjectCommand, {

package/lib/commonjs/logic/s3/generatePresignedUploadUrl.js.map

@@ -1 +1 @@
-{"version":3,"file":"generatePresignedUploadUrl.js","sourceRoot":"","sources":["../../../../src/logic/s3/generatePresignedUploadUrl.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,kDAAgE;AAChE,wEAA6D;AAE7D,oEAAoE;AACpE,wDAAqD;AAErD,wDAAwD;AACxD,wBAAwB;AACxB,uBAAuB;AACvB,oBAAoB;AACpB,0BAA0B;AAC1B,qCAAqC;AACrC,sCAAsC;AACtC,mEAAmE;AACnE,4DAA4D;AAE5D,kCAAkC;AAElC,8CAA8C;AAC9C,uBAAuB;AACvB,6DAA6D;AAC7D,MAAM;AAEN,iDAAiD;AACjD,wBAAwB;AACxB,kEAAkE;AAClE,MAAM;AAEN,gEAAgE;AAChE,0BAA0B;AAC1B,sBAAsB;AACtB,8BAA8B;AAC9B,gDAAgD;AAChD,QAAQ;AAER,aAAa;AACb,8BAA8B;AAC9B,mCAAmC;AACnC,OAAO;AACP,KAAK;AAEE,MAAM,0BAA0B,GAAG,CACxC,UAAkB,EAClB,SAAiB,EACjB,MAAc,EACd,YAAoB,EACpB,aAAsB,EACtB,WAAoB,EACH,EAAE;IACnB,oFAAoF;IACpF,yFAAyF;IACzF,2FAA2F;IAC3F,+FAA+F;IAC/F,MAAM,QAAQ,GAAG,IAAA,iCAAe,EAAC,oBAAQ,EAAE;QACzC,MAAM;QACN,0BAA0B,EAAE,eAAe;KAC5C,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,IAAI,4BAAgB,CAAC;QAC5C,MAAM,EAAE,UAAU;QAClB,GAAG,EAAE,SAAS;QACd,WAAW,EAAE,WAAW;QAExB,QAAQ,kCACH,CAAC,aAAa,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC,KACzD,kBAAkB,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,GAC1C;KACF,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,IAAA,mCAAY,EAAC,QAAQ,EAAE,gBAAgB,EAAE;QACzD,SAAS,EAAE,YAAY,GAAG,IAAI;KAC/B,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC,CAAA,CAAC;AAjCW,QAAA,0BAA0B,8BAiCrC","sourcesContent":["import { PutObjectCommand, S3Client } from '@aws-sdk/client-s3';\nimport { getSignedUrl } from '@aws-sdk/s3-request-presigner';\n\n// import { createPresignedPost } from '@aws-sdk/s3-presigned-post';\nimport { createAwsClient } from '../createAwsClient';\n\n// export const generatePresignedUploadFormUrl = async (\n//   bucketName: string,\n//   objectKey: string,\n//   region: string,\n//   expirationMs: number,\n//   contentType: string | undefined,\n//   maxSizeBytes?: number | undefined\n// ): Promise<{ url: string; fields: Record<string, string> }> => {\n//   const s3Client = createAwsClient(S3Client, { region });\n\n//   const conditions: any[] = [];\n\n//   // Add content type condition if provided\n//   if (contentType) {\n//     conditions.push(['eq', '$Content-Type', contentType]);\n//   }\n\n//   // Add file size limit condition if provided\n//   if (maxSizeBytes) {\n//     conditions.push(['content-length-range', 0, maxSizeBytes]);\n//   }\n\n//   const presignedPost = await createPresignedPost(s3Client, {\n//     Bucket: bucketName,\n//     Key: objectKey,\n//     Conditions: conditions,\n//     Expires: Math.floor(expirationMs / 1000),\n//   });\n\n//   return {\n//     url: presignedPost.url,\n//     fields: presignedPost.fields\n//   };\n// };\n\nexport const generatePresignedUploadUrl = async (\n  bucketName: string,\n  objectKey: string,\n  region: string,\n  expirationMs: number,\n  correlationId?: string,\n  contentType?: string,\n): Promise<string> => {\n  // WHEN_REQUIRED disables the SDK v3 default request checksum (CRC32). Otherwise the\n  // presigner bakes an empty-body checksum (x-amz-checksum-crc32=AAAAAA==) into the signed\n  // URL, which never matches the real body the browser PUTs — S3 then rejects the upload and\n  // the failure surfaces in the browser as a CORS error (the error response has no ACAO header).\n  const s3Client = createAwsClient(S3Client, {\n    region,\n    requestChecksumCalculation: 'WHEN_REQUIRED',\n  });\n\n  const putObjectCommand = new PutObjectCommand({\n    Bucket: bucketName,\n    Key: objectKey,\n    ContentType: contentType,\n\n    Metadata: {\n      ...(correlationId && { 'correlation-id': correlationId }),\n      'upload-timestamp': Date.now().toString(),\n    },\n  });\n\n  const url = await getSignedUrl(s3Client, putObjectCommand, {\n    expiresIn: expirationMs / 1000,\n  });\n\n  return url;\n};\n"]}
+{"version":3,"file":"generatePresignedUploadUrl.js","sourceRoot":"","sources":["../../../../src/logic/s3/generatePresignedUploadUrl.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,kDAAgE;AAChE,wEAA6D;AAE7D,oEAAoE;AACpE,wDAAqD;AAErD,wDAAwD;AACxD,wBAAwB;AACxB,uBAAuB;AACvB,oBAAoB;AACpB,0BAA0B;AAC1B,qCAAqC;AACrC,sCAAsC;AACtC,mEAAmE;AACnE,4DAA4D;AAE5D,kCAAkC;AAElC,8CAA8C;AAC9C,uBAAuB;AACvB,6DAA6D;AAC7D,MAAM;AAEN,iDAAiD;AACjD,wBAAwB;AACxB,kEAAkE;AAClE,MAAM;AAEN,gEAAgE;AAChE,0BAA0B;AAC1B,sBAAsB;AACtB,8BAA8B;AAC9B,gDAAgD;AAChD,QAAQ;AAER,aAAa;AACb,8BAA8B;AAC9B,mCAAmC;AACnC,OAAO;AACP,KAAK;AAEE,MAAM,0BAA0B,GAAG,CACxC,UAAkB,EAClB,SAAiB,EACjB,MAAc,EACd,YAAoB,EACpB,aAAsB,EACtB,WAAoB,EACpB,kBAA2B,EACV,EAAE;IACnB,oFAAoF;IACpF,yFAAyF;IACzF,2FAA2F;IAC3F,+FAA+F;IAC/F,MAAM,QAAQ,GAAG,IAAA,iCAAe,EAAC,oBAAQ,EAAE;QACzC,MAAM;QACN,0BAA0B,EAAE,eAAe;KAC5C,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,IAAI,4BAAgB,CAAC;QAC5C,MAAM,EAAE,UAAU;QAClB,GAAG,EAAE,SAAS;QACd,WAAW,EAAE,WAAW;QACxB,+FAA+F;QAC/F,oGAAoG;QACpG,kBAAkB,EAAE,kBAAkB;QAEtC,QAAQ,kCACH,CAAC,aAAa,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC,KACzD,kBAAkB,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,GAC1C;KACF,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,IAAA,mCAAY,EAAC,QAAQ,EAAE,gBAAgB,EAAE;QACzD,SAAS,EAAE,YAAY,GAAG,IAAI;KAC/B,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC,CAAA,CAAC;AArCW,QAAA,0BAA0B,8BAqCrC","sourcesContent":["import { PutObjectCommand, S3Client } from '@aws-sdk/client-s3';\nimport { getSignedUrl } from '@aws-sdk/s3-request-presigner';\n\n// import { createPresignedPost } from '@aws-sdk/s3-presigned-post';\nimport { createAwsClient } from '../createAwsClient';\n\n// export const generatePresignedUploadFormUrl = async (\n//   bucketName: string,\n//   objectKey: string,\n//   region: string,\n//   expirationMs: number,\n//   contentType: string | undefined,\n//   maxSizeBytes?: number | undefined\n// ): Promise<{ url: string; fields: Record<string, string> }> => {\n//   const s3Client = createAwsClient(S3Client, { region });\n\n//   const conditions: any[] = [];\n\n//   // Add content type condition if provided\n//   if (contentType) {\n//     conditions.push(['eq', '$Content-Type', contentType]);\n//   }\n\n//   // Add file size limit condition if provided\n//   if (maxSizeBytes) {\n//     conditions.push(['content-length-range', 0, maxSizeBytes]);\n//   }\n\n//   const presignedPost = await createPresignedPost(s3Client, {\n//     Bucket: bucketName,\n//     Key: objectKey,\n//     Conditions: conditions,\n//     Expires: Math.floor(expirationMs / 1000),\n//   });\n\n//   return {\n//     url: presignedPost.url,\n//     fields: presignedPost.fields\n//   };\n// };\n\nexport const generatePresignedUploadUrl = async (\n  bucketName: string,\n  objectKey: string,\n  region: string,\n  expirationMs: number,\n  correlationId?: string,\n  contentType?: string,\n  contentDisposition?: string,\n): Promise<string> => {\n  // WHEN_REQUIRED disables the SDK v3 default request checksum (CRC32). Otherwise the\n  // presigner bakes an empty-body checksum (x-amz-checksum-crc32=AAAAAA==) into the signed\n  // URL, which never matches the real body the browser PUTs — S3 then rejects the upload and\n  // the failure surfaces in the browser as a CORS error (the error response has no ACAO header).\n  const s3Client = createAwsClient(S3Client, {\n    region,\n    requestChecksumCalculation: 'WHEN_REQUIRED',\n  });\n\n  const putObjectCommand = new PutObjectCommand({\n    Bucket: bucketName,\n    Key: objectKey,\n    ContentType: contentType,\n    // Signed into the URL: the client's PUT must send the matching Content-Disposition header, and\n    // S3 stores it so later GETs serve it back (e.g. 'inline' to preview a PDF instead of downloading).\n    ContentDisposition: contentDisposition,\n\n    Metadata: {\n      ...(correlationId && { 'correlation-id': correlationId }),\n      'upload-timestamp': Date.now().toString(),\n    },\n  });\n\n  const url = await getSignedUrl(s3Client, putObjectCommand, {\n    expiresIn: expirationMs / 1000,\n  });\n\n  return url;\n};\n"]}

package/lib/esm/getActionProcessor/core/file/getFileGenerateTemporaryUploadSecureUrlActionProcessor.js

@@ -6,13 +6,13 @@ import { resolveStorageDriveBucketName } from './utils';
 // SigV4 presigned URLs cannot expire more than 7 days in the future
 const maxExpirationMs = 7 * 24 * 60 * 60 * 1000;
 const getProcessFileGenerateTemporaryUploadSecureUrl = (qpqConfig) => {
-    return async ({ drive, filepath, expirationMs, contentType, scope }, session) => {
+    return async ({ drive, filepath, expirationMs, contentType, contentDisposition, scope }, session) => {
         if (expirationMs > maxExpirationMs) {
             return actionResultError(FileGenerateTemporaryUploadSecureUrlErrorTypeEnum.ExpirationTooLong, 'Expiration exceeds the 7 day maximum for presigned URLs');
         }
         try {
             const s3BucketName = resolveStorageDriveBucketName(drive, qpqConfig);
-            const url = await generatePresignedUploadUrl(s3BucketName, composeScopedFilePath(scope, filepath), qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig), expirationMs, session.correlation, contentType);
+            const url = await generatePresignedUploadUrl(s3BucketName, composeScopedFilePath(scope, filepath), qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig), expirationMs, session.correlation, contentType, contentDisposition);
             return actionResult(url);
         }
         catch (error) {

package/lib/esm/getActionProcessor/core/file/getFileGenerateTemporaryUploadSecureUrlActionProcessor.js.map

@@ -1 +1 @@
-{"version":3,"file":"getFileGenerateTemporaryUploadSecureUrlActionProcessor.js","sourceRoot":"","sources":["../../../../../src/getActionProcessor/core/file/getFileGenerateTemporaryUploadSecureUrlActionProcessor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAoD,iBAAiB,EAAE,gCAAgC,EAAa,MAAM,iBAAiB,CAAC;AACnJ,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,cAAc,EAEd,iDAAiD,GAClD,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAC1F,OAAO,EAAE,6BAA6B,EAAE,MAAM,SAAS,CAAC;AAExD,oEAAoE;AACpE,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD,MAAM,8CAA8C,GAAG,CAAC,SAAoB,EAAuD,EAAE;IACnI,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE;QAC9E,IAAI,YAAY,GAAG,eAAe,EAAE,CAAC;YACnC,OAAO,iBAAiB,CACtB,iDAAiD,CAAC,iBAAiB,EACnE,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,6BAA6B,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACrE,MAAM,GAAG,GAAG,MAAM,0BAA0B,CAC1C,YAAY,EACZ,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,EACtC,iBAAiB,CAAC,gCAAgC,CAAC,SAAS,CAAC,EAC7D,YAAY,EACZ,OAAO,CAAC,WAAW,EACnB,WAAW,CACZ,CAAC;YAEF,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,qEAAqE;YACrE,uDAAuD;YACvD,OAAO,gCAAgC,CAAC,KAAK,EAAE;gBAC7C,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,iDAAiD,CAAC,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC;aAC/H,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sDAAsD,GAAgC,KAAK,EACtG,SAAoB,EACU,EAAE,CAAC,CAAC;IAClC,CAAC,cAAc,CAAC,gCAAgC,CAAC,EAAE,8CAA8C,CAAC,SAAS,CAAC;CAC7G,CAAC,CAAC","sourcesContent":["import { qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport { ActionProcessorList, ActionProcessorListResolver, actionResultError, actionResultErrorFromCaughtError, QPQConfig } from 'quidproquo-core';\nimport {\n  actionResult,\n  composeScopedFilePath,\n  FileActionType,\n  FileGenerateTemporaryUploadSecureUrlActionProcessor,\n  FileGenerateTemporaryUploadSecureUrlErrorTypeEnum,\n} from 'quidproquo-core';\n\nimport { generatePresignedUploadUrl } from '../../../logic/s3/generatePresignedUploadUrl';\nimport { resolveStorageDriveBucketName } from './utils';\n\n// SigV4 presigned URLs cannot expire more than 7 days in the future\nconst maxExpirationMs = 7 * 24 * 60 * 60 * 1000;\n\nconst getProcessFileGenerateTemporaryUploadSecureUrl = (qpqConfig: QPQConfig): FileGenerateTemporaryUploadSecureUrlActionProcessor => {\n  return async ({ drive, filepath, expirationMs, contentType, scope }, session) => {\n    if (expirationMs > maxExpirationMs) {\n      return actionResultError(\n        FileGenerateTemporaryUploadSecureUrlErrorTypeEnum.ExpirationTooLong,\n        'Expiration exceeds the 7 day maximum for presigned URLs',\n      );\n    }\n\n    try {\n      const s3BucketName = resolveStorageDriveBucketName(drive, qpqConfig);\n      const url = await generatePresignedUploadUrl(\n        s3BucketName,\n        composeScopedFilePath(scope, filepath),\n        qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig),\n        expirationMs,\n        session.correlation,\n        contentType,\n      );\n\n      return actionResult(url);\n    } catch (error: unknown) {\n      // Name-keyed, not instanceof: under npm link / module federation the\n      // error can come from another copy of quidproquo-core.\n      return actionResultErrorFromCaughtError(error, {\n        InvalidScopeError: (error) => actionResultError(FileGenerateTemporaryUploadSecureUrlErrorTypeEnum.InvalidScope, error.message),\n      });\n    }\n  };\n};\n\nexport const getFileGenerateTemporaryUploadSecureUrlActionProcessor: ActionProcessorListResolver = async (\n  qpqConfig: QPQConfig,\n): Promise<ActionProcessorList> => ({\n  [FileActionType.GenerateTemporaryUploadSecureUrl]: getProcessFileGenerateTemporaryUploadSecureUrl(qpqConfig),\n});\n"]}
+{"version":3,"file":"getFileGenerateTemporaryUploadSecureUrlActionProcessor.js","sourceRoot":"","sources":["../../../../../src/getActionProcessor/core/file/getFileGenerateTemporaryUploadSecureUrlActionProcessor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAoD,iBAAiB,EAAE,gCAAgC,EAAa,MAAM,iBAAiB,CAAC;AACnJ,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,cAAc,EAEd,iDAAiD,GAClD,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAC1F,OAAO,EAAE,6BAA6B,EAAE,MAAM,SAAS,CAAC;AAExD,oEAAoE;AACpE,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD,MAAM,8CAA8C,GAAG,CAAC,SAAoB,EAAuD,EAAE;IACnI,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE;QAClG,IAAI,YAAY,GAAG,eAAe,EAAE,CAAC;YACnC,OAAO,iBAAiB,CACtB,iDAAiD,CAAC,iBAAiB,EACnE,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,6BAA6B,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACrE,MAAM,GAAG,GAAG,MAAM,0BAA0B,CAC1C,YAAY,EACZ,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,EACtC,iBAAiB,CAAC,gCAAgC,CAAC,SAAS,CAAC,EAC7D,YAAY,EACZ,OAAO,CAAC,WAAW,EACnB,WAAW,EACX,kBAAkB,CACnB,CAAC;YAEF,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,qEAAqE;YACrE,uDAAuD;YACvD,OAAO,gCAAgC,CAAC,KAAK,EAAE;gBAC7C,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,iDAAiD,CAAC,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC;aAC/H,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sDAAsD,GAAgC,KAAK,EACtG,SAAoB,EACU,EAAE,CAAC,CAAC;IAClC,CAAC,cAAc,CAAC,gCAAgC,CAAC,EAAE,8CAA8C,CAAC,SAAS,CAAC;CAC7G,CAAC,CAAC","sourcesContent":["import { qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport { ActionProcessorList, ActionProcessorListResolver, actionResultError, actionResultErrorFromCaughtError, QPQConfig } from 'quidproquo-core';\nimport {\n  actionResult,\n  composeScopedFilePath,\n  FileActionType,\n  FileGenerateTemporaryUploadSecureUrlActionProcessor,\n  FileGenerateTemporaryUploadSecureUrlErrorTypeEnum,\n} from 'quidproquo-core';\n\nimport { generatePresignedUploadUrl } from '../../../logic/s3/generatePresignedUploadUrl';\nimport { resolveStorageDriveBucketName } from './utils';\n\n// SigV4 presigned URLs cannot expire more than 7 days in the future\nconst maxExpirationMs = 7 * 24 * 60 * 60 * 1000;\n\nconst getProcessFileGenerateTemporaryUploadSecureUrl = (qpqConfig: QPQConfig): FileGenerateTemporaryUploadSecureUrlActionProcessor => {\n  return async ({ drive, filepath, expirationMs, contentType, contentDisposition, scope }, session) => {\n    if (expirationMs > maxExpirationMs) {\n      return actionResultError(\n        FileGenerateTemporaryUploadSecureUrlErrorTypeEnum.ExpirationTooLong,\n        'Expiration exceeds the 7 day maximum for presigned URLs',\n      );\n    }\n\n    try {\n      const s3BucketName = resolveStorageDriveBucketName(drive, qpqConfig);\n      const url = await generatePresignedUploadUrl(\n        s3BucketName,\n        composeScopedFilePath(scope, filepath),\n        qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig),\n        expirationMs,\n        session.correlation,\n        contentType,\n        contentDisposition,\n      );\n\n      return actionResult(url);\n    } catch (error: unknown) {\n      // Name-keyed, not instanceof: under npm link / module federation the\n      // error can come from another copy of quidproquo-core.\n      return actionResultErrorFromCaughtError(error, {\n        InvalidScopeError: (error) => actionResultError(FileGenerateTemporaryUploadSecureUrlErrorTypeEnum.InvalidScope, error.message),\n      });\n    }\n  };\n};\n\nexport const getFileGenerateTemporaryUploadSecureUrlActionProcessor: ActionProcessorListResolver = async (\n  qpqConfig: QPQConfig,\n): Promise<ActionProcessorList> => ({\n  [FileActionType.GenerateTemporaryUploadSecureUrl]: getProcessFileGenerateTemporaryUploadSecureUrl(qpqConfig),\n});\n"]}

package/lib/esm/getActionProcessor/core/userDirectory/getUserDirectoryRevokeRefreshTokenActionProcessor.d.ts

@@ -0,0 +1,2 @@
+import { ActionProcessorListResolver } from 'quidproquo-core';
+export declare const getUserDirectoryRevokeRefreshTokenActionProcessor: ActionProcessorListResolver;

package/lib/esm/getActionProcessor/core/userDirectory/getUserDirectoryRevokeRefreshTokenActionProcessor.js

@@ -0,0 +1,26 @@
+import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
+import { actionResult, actionResultError, actionResultErrorFromCaughtError, UserDirectoryActionType, UserDirectoryRevokeRefreshTokenErrorTypeEnum, } from 'quidproquo-core';
+import { getCFExportNameUserPoolClientIdFromConfig, getCFExportNameUserPoolIdFromConfig } from '../../../awsNamingUtils';
+import { getExportedValue } from '../../../logic/cloudformation/getExportedValue';
+import { revokeRefreshToken } from '../../../logic/cognito/revokeRefreshToken';
+const getProcessRevokeRefreshToken = (qpqConfig) => {
+    return async ({ userDirectoryName, refreshToken }) => {
+        const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
+        const userPoolId = await getExportedValue(getCFExportNameUserPoolIdFromConfig(userDirectoryName, qpqConfig), region);
+        const userPoolClientId = await getExportedValue(getCFExportNameUserPoolClientIdFromConfig(userDirectoryName, qpqConfig), region);
+        try {
+            await revokeRefreshToken(userPoolId, userPoolClientId, region, refreshToken);
+            return actionResult(void 0);
+        }
+        catch (error) {
+            return actionResultErrorFromCaughtError(error, {
+                NotAuthorizedException: () => actionResultError(UserDirectoryRevokeRefreshTokenErrorTypeEnum.Unauthorized, 'Refresh token is invalid or already revoked'),
+                TooManyRequestsException: () => actionResultError(UserDirectoryRevokeRefreshTokenErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+            });
+        }
+    };
+};
+export const getUserDirectoryRevokeRefreshTokenActionProcessor = async (qpqConfig) => ({
+    [UserDirectoryActionType.RevokeRefreshToken]: getProcessRevokeRefreshToken(qpqConfig),
+});
+//# sourceMappingURL=getUserDirectoryRevokeRefreshTokenActionProcessor.js.map

package/lib/esm/getActionProcessor/core/userDirectory/getUserDirectoryRevokeRefreshTokenActionProcessor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getUserDirectoryRevokeRefreshTokenActionProcessor.js","sourceRoot":"","sources":["../../../../../src/getActionProcessor/core/userDirectory/getUserDirectoryRevokeRefreshTokenActionProcessor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAGL,YAAY,EACZ,iBAAiB,EACjB,gCAAgC,EAEhC,uBAAuB,EAEvB,4CAA4C,GAC7C,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,yCAAyC,EAAE,mCAAmC,EAAE,MAAM,yBAAyB,CAAC;AACzH,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAE/E,MAAM,4BAA4B,GAAG,CAAC,SAAoB,EAAkD,EAAE;IAC5G,OAAO,KAAK,EAAE,EAAE,iBAAiB,EAAE,YAAY,EAAE,EAAE,EAAE;QACnD,MAAM,MAAM,GAAG,iBAAiB,CAAC,gCAAgC,CAAC,SAAS,CAAC,CAAC;QAE7E,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,mCAAmC,CAAC,iBAAiB,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;QAErH,MAAM,gBAAgB,GAAG,MAAM,gBAAgB,CAAC,yCAAyC,CAAC,iBAAiB,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;QAEjI,IAAI,CAAC;YACH,MAAM,kBAAkB,CAAC,UAAU,EAAE,gBAAgB,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;YAE7E,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,OAAO,gCAAgC,CAAC,KAAK,EAAE;gBAC7C,sBAAsB,EAAE,GAAG,EAAE,CAC3B,iBAAiB,CAAC,4CAA4C,CAAC,YAAY,EAAE,6CAA6C,CAAC;gBAC7H,wBAAwB,EAAE,GAAG,EAAE,CAC7B,iBAAiB,CAAC,4CAA4C,CAAC,aAAa,EAAE,2CAA2C,CAAC;aAC7H,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iDAAiD,GAAgC,KAAK,EACjG,SAAoB,EACU,EAAE,CAAC,CAAC;IAClC,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,EAAE,4BAA4B,CAAC,SAAS,CAAC;CACtF,CAAC,CAAC","sourcesContent":["import { qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport {\n  ActionProcessorList,\n  ActionProcessorListResolver,\n  actionResult,\n  actionResultError,\n  actionResultErrorFromCaughtError,\n  QPQConfig,\n  UserDirectoryActionType,\n  UserDirectoryRevokeRefreshTokenActionProcessor,\n  UserDirectoryRevokeRefreshTokenErrorTypeEnum,\n} from 'quidproquo-core';\n\nimport { getCFExportNameUserPoolClientIdFromConfig, getCFExportNameUserPoolIdFromConfig } from '../../../awsNamingUtils';\nimport { getExportedValue } from '../../../logic/cloudformation/getExportedValue';\nimport { revokeRefreshToken } from '../../../logic/cognito/revokeRefreshToken';\n\nconst getProcessRevokeRefreshToken = (qpqConfig: QPQConfig): UserDirectoryRevokeRefreshTokenActionProcessor => {\n  return async ({ userDirectoryName, refreshToken }) => {\n    const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);\n\n    const userPoolId = await getExportedValue(getCFExportNameUserPoolIdFromConfig(userDirectoryName, qpqConfig), region);\n\n    const userPoolClientId = await getExportedValue(getCFExportNameUserPoolClientIdFromConfig(userDirectoryName, qpqConfig), region);\n\n    try {\n      await revokeRefreshToken(userPoolId, userPoolClientId, region, refreshToken);\n\n      return actionResult(void 0);\n    } catch (error: unknown) {\n      return actionResultErrorFromCaughtError(error, {\n        NotAuthorizedException: () =>\n          actionResultError(UserDirectoryRevokeRefreshTokenErrorTypeEnum.Unauthorized, 'Refresh token is invalid or already revoked'),\n        TooManyRequestsException: () =>\n          actionResultError(UserDirectoryRevokeRefreshTokenErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),\n      });\n    }\n  };\n};\n\nexport const getUserDirectoryRevokeRefreshTokenActionProcessor: ActionProcessorListResolver = async (\n  qpqConfig: QPQConfig,\n): Promise<ActionProcessorList> => ({\n  [UserDirectoryActionType.RevokeRefreshToken]: getProcessRevokeRefreshToken(qpqConfig),\n});\n"]}

package/lib/esm/getActionProcessor/core/userDirectory/getUserDirectorySignOutUserActionProcessor.d.ts

@@ -0,0 +1,2 @@
+import { ActionProcessorListResolver } from 'quidproquo-core';
+export declare const getUserDirectorySignOutUserActionProcessor: ActionProcessorListResolver;

package/lib/esm/getActionProcessor/core/userDirectory/getUserDirectorySignOutUserActionProcessor.js

@@ -0,0 +1,22 @@
+import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
+import { actionResult, actionResultError, actionResultErrorFromCaughtError, UserDirectoryActionType, UserDirectorySignOutUserErrorTypeEnum, } from 'quidproquo-core';
+import { globalSignOut } from '../../../logic/cognito/globalSignOut';
+const getProcessSignOutUser = (qpqConfig) => {
+    return async ({ accessToken }) => {
+        const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
+        try {
+            await globalSignOut(accessToken, region);
+            return actionResult(void 0);
+        }
+        catch (error) {
+            return actionResultErrorFromCaughtError(error, {
+                NotAuthorizedException: () => actionResultError(UserDirectorySignOutUserErrorTypeEnum.Unauthorized, 'Access token is invalid or has expired'),
+                TooManyRequestsException: () => actionResultError(UserDirectorySignOutUserErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+            });
+        }
+    };
+};
+export const getUserDirectorySignOutUserActionProcessor = async (qpqConfig) => ({
+    [UserDirectoryActionType.SignOutUser]: getProcessSignOutUser(qpqConfig),
+});
+//# sourceMappingURL=getUserDirectorySignOutUserActionProcessor.js.map

package/lib/esm/getActionProcessor/core/userDirectory/getUserDirectorySignOutUserActionProcessor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getUserDirectorySignOutUserActionProcessor.js","sourceRoot":"","sources":["../../../../../src/getActionProcessor/core/userDirectory/getUserDirectorySignOutUserActionProcessor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAGL,YAAY,EACZ,iBAAiB,EACjB,gCAAgC,EAEhC,uBAAuB,EAEvB,qCAAqC,GACtC,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAErE,MAAM,qBAAqB,GAAG,CAAC,SAAoB,EAA2C,EAAE;IAC9F,OAAO,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;QAC/B,MAAM,MAAM,GAAG,iBAAiB,CAAC,gCAAgC,CAAC,SAAS,CAAC,CAAC;QAE7E,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAEzC,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,OAAO,gCAAgC,CAAC,KAAK,EAAE;gBAC7C,sBAAsB,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,qCAAqC,CAAC,YAAY,EAAE,wCAAwC,CAAC;gBAC7I,wBAAwB,EAAE,GAAG,EAAE,CAC7B,iBAAiB,CAAC,qCAAqC,CAAC,aAAa,EAAE,2CAA2C,CAAC;aACtH,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,0CAA0C,GAAgC,KAAK,EAC1F,SAAoB,EACU,EAAE,CAAC,CAAC;IAClC,CAAC,uBAAuB,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC,SAAS,CAAC;CACxE,CAAC,CAAC","sourcesContent":["import { qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport {\n  ActionProcessorList,\n  ActionProcessorListResolver,\n  actionResult,\n  actionResultError,\n  actionResultErrorFromCaughtError,\n  QPQConfig,\n  UserDirectoryActionType,\n  UserDirectorySignOutUserActionProcessor,\n  UserDirectorySignOutUserErrorTypeEnum,\n} from 'quidproquo-core';\n\nimport { globalSignOut } from '../../../logic/cognito/globalSignOut';\n\nconst getProcessSignOutUser = (qpqConfig: QPQConfig): UserDirectorySignOutUserActionProcessor => {\n  return async ({ accessToken }) => {\n    const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);\n\n    try {\n      await globalSignOut(accessToken, region);\n\n      return actionResult(void 0);\n    } catch (error: unknown) {\n      return actionResultErrorFromCaughtError(error, {\n        NotAuthorizedException: () => actionResultError(UserDirectorySignOutUserErrorTypeEnum.Unauthorized, 'Access token is invalid or has expired'),\n        TooManyRequestsException: () =>\n          actionResultError(UserDirectorySignOutUserErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),\n      });\n    }\n  };\n};\n\nexport const getUserDirectorySignOutUserActionProcessor: ActionProcessorListResolver = async (\n  qpqConfig: QPQConfig,\n): Promise<ActionProcessorList> => ({\n  [UserDirectoryActionType.SignOutUser]: getProcessSignOutUser(qpqConfig),\n});\n"]}

package/lib/esm/getActionProcessor/core/userDirectory/index.js

@@ -14,9 +14,11 @@ import { getUserDirectoryReadAccessTokenActionProcessor } from './getUserDirecto
 import { getUserDirectoryRefreshTokenActionProcessor } from './getUserDirectoryRefreshTokenActionProcessor';
 import { getUserDirectoryRequestEmailVerificationActionProcessor } from './getUserDirectoryRequestEmailVerificationActionProcessor';
 import { getUserDirectoryRespondToAuthChallengeActionProcessor } from './getUserDirectoryRespondToAuthChallengeActionProcessor';
+import { getUserDirectoryRevokeRefreshTokenActionProcessor } from './getUserDirectoryRevokeRefreshTokenActionProcessor';
 import { getUserDirectorySetAccessTokenActionProcessor } from './getUserDirectorySetAccessTokenActionProcessor';
 import { getUserDirectorySetPasswordActionProcessor } from './getUserDirectorySetPasswordActionProcessor';
 import { getUserDirectorySetUserAttributesActionProcessor } from './getUserDirectorySetUserAttributesActionProcessor';
+import { getUserDirectorySignOutUserActionProcessor } from './getUserDirectorySignOutUserActionProcessor';
 export const getUserDirectoryActionProcessor = async (qpqConfig, dynamicModuleLoader) => ({
     ...(await getUserDirectoryAssociateSoftwareTokenActionProcessor(qpqConfig, dynamicModuleLoader)),
     ...(await getUserDirectoryAuthenticateUserActionProcessor(qpqConfig, dynamicModuleLoader)),
@@ -32,10 +34,12 @@ export const getUserDirectoryActionProcessor = async (qpqConfig, dynamicModuleLo
     ...(await getUserDirectoryGetUsersByAttributeActionProcessor(qpqConfig, dynamicModuleLoader)),
     ...(await getUserDirectoryReadAccessTokenActionProcessor(qpqConfig, dynamicModuleLoader)),
     ...(await getUserDirectoryRefreshTokenActionProcessor(qpqConfig, dynamicModuleLoader)),
+    ...(await getUserDirectoryRevokeRefreshTokenActionProcessor(qpqConfig, dynamicModuleLoader)),
     ...(await getUserDirectoryRequestEmailVerificationActionProcessor(qpqConfig, dynamicModuleLoader)),
     ...(await getUserDirectoryRespondToAuthChallengeActionProcessor(qpqConfig, dynamicModuleLoader)),
     ...(await getUserDirectorySetAccessTokenActionProcessor(qpqConfig, dynamicModuleLoader)),
     ...(await getUserDirectorySetPasswordActionProcessor(qpqConfig, dynamicModuleLoader)),
     ...(await getUserDirectorySetUserAttributesActionProcessor(qpqConfig, dynamicModuleLoader)),
+    ...(await getUserDirectorySignOutUserActionProcessor(qpqConfig, dynamicModuleLoader)),
 });
 //# sourceMappingURL=index.js.map

package/lib/esm/getActionProcessor/core/userDirectory/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/getActionProcessor/core/userDirectory/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qDAAqD,EAAE,MAAM,yDAAyD,CAAC;AAChI,OAAO,EAAE,+CAA+C,EAAE,MAAM,mDAAmD,CAAC;AACpH,OAAO,EAAE,6CAA6C,EAAE,MAAM,iDAAiD,CAAC;AAChH,OAAO,EAAE,uDAAuD,EAAE,MAAM,2DAA2D,CAAC;AACpI,OAAO,EAAE,oDAAoD,EAAE,MAAM,wDAAwD,CAAC;AAC9H,OAAO,EAAE,yCAAyC,EAAE,MAAM,6CAA6C,CAAC;AACxG,OAAO,EAAE,gDAAgD,EAAE,MAAM,oDAAoD,CAAC;AACtH,OAAO,EAAE,6CAA6C,EAAE,MAAM,iDAAiD,CAAC;AAChH,OAAO,EAAE,gDAAgD,EAAE,MAAM,oDAAoD,CAAC;AACtH,OAAO,EAAE,wDAAwD,EAAE,MAAM,4DAA4D,CAAC;AACtI,OAAO,EAAE,uCAAuC,EAAE,MAAM,2CAA2C,CAAC;AACpG,OAAO,EAAE,kDAAkD,EAAE,MAAM,sDAAsD,CAAC;AAC1H,OAAO,EAAE,8CAA8C,EAAE,MAAM,kDAAkD,CAAC;AAClH,OAAO,EAAE,2CAA2C,EAAE,MAAM,+CAA+C,CAAC;AAC5G,OAAO,EAAE,uDAAuD,EAAE,MAAM,2DAA2D,CAAC;AACpI,OAAO,EAAE,qDAAqD,EAAE,MAAM,yDAAyD,CAAC;AAChI,OAAO,EAAE,6CAA6C,EAAE,MAAM,iDAAiD,CAAC;AAChH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,gDAAgD,EAAE,MAAM,oDAAoD,CAAC;AAEtH,MAAM,CAAC,MAAM,+BAA+B,GAAgC,KAAK,EAC/E,SAAoB,EACpB,mBAAwC,EACV,EAAE,CAAC,CAAC;IAClC,GAAG,CAAC,MAAM,qDAAqD,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAChG,GAAG,CAAC,MAAM,+CAA+C,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAC1F,GAAG,CAAC,MAAM,6CAA6C,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACxF,GAAG,CAAC,MAAM,uDAAuD,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAClG,GAAG,CAAC,MAAM,oDAAoD,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAC/F,GAAG,CAAC,MAAM,yCAAyC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACpF,GAAG,CAAC,MAAM,gDAAgD,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAC3F,GAAG,CAAC,MAAM,6CAA6C,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACxF,GAAG,CAAC,MAAM,gDAAgD,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAC3F,GAAG,CAAC,MAAM,wDAAwD,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACnG,GAAG,CAAC,MAAM,uCAAuC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAClF,GAAG,CAAC,MAAM,kDAAkD,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAC7F,GAAG,CAAC,MAAM,8CAA8C,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACzF,GAAG,CAAC,MAAM,2CAA2C,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACtF,GAAG,CAAC,MAAM,uDAAuD,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAClG,GAAG,CAAC,MAAM,qDAAqD,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAChG,GAAG,CAAC,MAAM,6CAA6C,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACxF,GAAG,CAAC,MAAM,0CAA0C,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACrF,GAAG,CAAC,MAAM,gDAAgD,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;CAC5F,CAAC,CAAC","sourcesContent":["import { ActionProcessorList, ActionProcessorListResolver, DynamicModuleLoader, QPQConfig } from 'quidproquo-core';\n\nimport { getUserDirectoryAssociateSoftwareTokenActionProcessor } from './getUserDirectoryAssociateSoftwareTokenActionProcessor';\nimport { getUserDirectoryAuthenticateUserActionProcessor } from './getUserDirectoryAuthenticateUserActionProcessor';\nimport { getUserDirectoryChangePasswordActionProcessor } from './getUserDirectoryChangePasswordActionProcessor';\nimport { getUserDirectoryConfirmEmailVerificationActionProcessor } from './getUserDirectoryConfirmEmailVerificationActionProcessor';\nimport { getUserDirectoryConfirmForgotPasswordActionProcessor } from './getUserDirectoryConfirmForgotPasswordActionProcessor';\nimport { getUserDirectoryCreateUserActionProcessor } from './getUserDirectoryCreateUserActionProcessor';\nimport { getUserDirectoryDecodeAccessTokenActionProcessor } from './getUserDirectoryDecodeAccessTokenActionProcessor';\nimport { getUserDirectoryForgotPasswordActionProcessor } from './getUserDirectoryForgotPasswordActionProcessor';\nimport { getUserDirectoryGetUserAttributesActionProcessor } from './getUserDirectoryGetUserAttributesActionProcessor';\nimport { getUserDirectoryGetUserAttributesByUserIdActionProcessor } from './getUserDirectoryGetUserAttributesByUserIdActionProcessor';\nimport { getUserDirectoryGetUsersActionProcessor } from './getUserDirectoryGetUsersActionProcessor';\nimport { getUserDirectoryGetUsersByAttributeActionProcessor } from './getUserDirectoryGetUsersByAttributeActionProcessor';\nimport { getUserDirectoryReadAccessTokenActionProcessor } from './getUserDirectoryReadAccessTokenActionProcessor';\nimport { getUserDirectoryRefreshTokenActionProcessor } from './getUserDirectoryRefreshTokenActionProcessor';\nimport { getUserDirectoryRequestEmailVerificationActionProcessor } from './getUserDirectoryRequestEmailVerificationActionProcessor';\nimport { getUserDirectoryRespondToAuthChallengeActionProcessor } from './getUserDirectoryRespondToAuthChallengeActionProcessor';\nimport { getUserDirectorySetAccessTokenActionProcessor } from './getUserDirectorySetAccessTokenActionProcessor';\nimport { getUserDirectorySetPasswordActionProcessor } from './getUserDirectorySetPasswordActionProcessor';\nimport { getUserDirectorySetUserAttributesActionProcessor } from './getUserDirectorySetUserAttributesActionProcessor';\n\nexport const getUserDirectoryActionProcessor: ActionProcessorListResolver = async (\n  qpqConfig: QPQConfig,\n  dynamicModuleLoader: DynamicModuleLoader,\n): Promise<ActionProcessorList> => ({\n  ...(await getUserDirectoryAssociateSoftwareTokenActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryAuthenticateUserActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryChangePasswordActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryConfirmEmailVerificationActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryConfirmForgotPasswordActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryCreateUserActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryDecodeAccessTokenActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryForgotPasswordActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryGetUserAttributesActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryGetUserAttributesByUserIdActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryGetUsersActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryGetUsersByAttributeActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryReadAccessTokenActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryRefreshTokenActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryRequestEmailVerificationActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryRespondToAuthChallengeActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectorySetAccessTokenActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectorySetPasswordActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectorySetUserAttributesActionProcessor(qpqConfig, dynamicModuleLoader)),\n});\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/getActionProcessor/core/userDirectory/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qDAAqD,EAAE,MAAM,yDAAyD,CAAC;AAChI,OAAO,EAAE,+CAA+C,EAAE,MAAM,mDAAmD,CAAC;AACpH,OAAO,EAAE,6CAA6C,EAAE,MAAM,iDAAiD,CAAC;AAChH,OAAO,EAAE,uDAAuD,EAAE,MAAM,2DAA2D,CAAC;AACpI,OAAO,EAAE,oDAAoD,EAAE,MAAM,wDAAwD,CAAC;AAC9H,OAAO,EAAE,yCAAyC,EAAE,MAAM,6CAA6C,CAAC;AACxG,OAAO,EAAE,gDAAgD,EAAE,MAAM,oDAAoD,CAAC;AACtH,OAAO,EAAE,6CAA6C,EAAE,MAAM,iDAAiD,CAAC;AAChH,OAAO,EAAE,gDAAgD,EAAE,MAAM,oDAAoD,CAAC;AACtH,OAAO,EAAE,wDAAwD,EAAE,MAAM,4DAA4D,CAAC;AACtI,OAAO,EAAE,uCAAuC,EAAE,MAAM,2CAA2C,CAAC;AACpG,OAAO,EAAE,kDAAkD,EAAE,MAAM,sDAAsD,CAAC;AAC1H,OAAO,EAAE,8CAA8C,EAAE,MAAM,kDAAkD,CAAC;AAClH,OAAO,EAAE,2CAA2C,EAAE,MAAM,+CAA+C,CAAC;AAC5G,OAAO,EAAE,uDAAuD,EAAE,MAAM,2DAA2D,CAAC;AACpI,OAAO,EAAE,qDAAqD,EAAE,MAAM,yDAAyD,CAAC;AAChI,OAAO,EAAE,iDAAiD,EAAE,MAAM,qDAAqD,CAAC;AACxH,OAAO,EAAE,6CAA6C,EAAE,MAAM,iDAAiD,CAAC;AAChH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,gDAAgD,EAAE,MAAM,oDAAoD,CAAC;AACtH,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAE1G,MAAM,CAAC,MAAM,+BAA+B,GAAgC,KAAK,EAC/E,SAAoB,EACpB,mBAAwC,EACV,EAAE,CAAC,CAAC;IAClC,GAAG,CAAC,MAAM,qDAAqD,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAChG,GAAG,CAAC,MAAM,+CAA+C,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAC1F,GAAG,CAAC,MAAM,6CAA6C,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACxF,GAAG,CAAC,MAAM,uDAAuD,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAClG,GAAG,CAAC,MAAM,oDAAoD,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAC/F,GAAG,CAAC,MAAM,yCAAyC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACpF,GAAG,CAAC,MAAM,gDAAgD,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAC3F,GAAG,CAAC,MAAM,6CAA6C,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACxF,GAAG,CAAC,MAAM,gDAAgD,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAC3F,GAAG,CAAC,MAAM,wDAAwD,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACnG,GAAG,CAAC,MAAM,uCAAuC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAClF,GAAG,CAAC,MAAM,kDAAkD,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAC7F,GAAG,CAAC,MAAM,8CAA8C,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACzF,GAAG,CAAC,MAAM,2CAA2C,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACtF,GAAG,CAAC,MAAM,iDAAiD,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAC5F,GAAG,CAAC,MAAM,uDAAuD,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAClG,GAAG,CAAC,MAAM,qDAAqD,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAChG,GAAG,CAAC,MAAM,6CAA6C,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACxF,GAAG,CAAC,MAAM,0CAA0C,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACrF,GAAG,CAAC,MAAM,gDAAgD,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAC3F,GAAG,CAAC,MAAM,0CAA0C,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;CACtF,CAAC,CAAC","sourcesContent":["import { ActionProcessorList, ActionProcessorListResolver, DynamicModuleLoader, QPQConfig } from 'quidproquo-core';\n\nimport { getUserDirectoryAssociateSoftwareTokenActionProcessor } from './getUserDirectoryAssociateSoftwareTokenActionProcessor';\nimport { getUserDirectoryAuthenticateUserActionProcessor } from './getUserDirectoryAuthenticateUserActionProcessor';\nimport { getUserDirectoryChangePasswordActionProcessor } from './getUserDirectoryChangePasswordActionProcessor';\nimport { getUserDirectoryConfirmEmailVerificationActionProcessor } from './getUserDirectoryConfirmEmailVerificationActionProcessor';\nimport { getUserDirectoryConfirmForgotPasswordActionProcessor } from './getUserDirectoryConfirmForgotPasswordActionProcessor';\nimport { getUserDirectoryCreateUserActionProcessor } from './getUserDirectoryCreateUserActionProcessor';\nimport { getUserDirectoryDecodeAccessTokenActionProcessor } from './getUserDirectoryDecodeAccessTokenActionProcessor';\nimport { getUserDirectoryForgotPasswordActionProcessor } from './getUserDirectoryForgotPasswordActionProcessor';\nimport { getUserDirectoryGetUserAttributesActionProcessor } from './getUserDirectoryGetUserAttributesActionProcessor';\nimport { getUserDirectoryGetUserAttributesByUserIdActionProcessor } from './getUserDirectoryGetUserAttributesByUserIdActionProcessor';\nimport { getUserDirectoryGetUsersActionProcessor } from './getUserDirectoryGetUsersActionProcessor';\nimport { getUserDirectoryGetUsersByAttributeActionProcessor } from './getUserDirectoryGetUsersByAttributeActionProcessor';\nimport { getUserDirectoryReadAccessTokenActionProcessor } from './getUserDirectoryReadAccessTokenActionProcessor';\nimport { getUserDirectoryRefreshTokenActionProcessor } from './getUserDirectoryRefreshTokenActionProcessor';\nimport { getUserDirectoryRequestEmailVerificationActionProcessor } from './getUserDirectoryRequestEmailVerificationActionProcessor';\nimport { getUserDirectoryRespondToAuthChallengeActionProcessor } from './getUserDirectoryRespondToAuthChallengeActionProcessor';\nimport { getUserDirectoryRevokeRefreshTokenActionProcessor } from './getUserDirectoryRevokeRefreshTokenActionProcessor';\nimport { getUserDirectorySetAccessTokenActionProcessor } from './getUserDirectorySetAccessTokenActionProcessor';\nimport { getUserDirectorySetPasswordActionProcessor } from './getUserDirectorySetPasswordActionProcessor';\nimport { getUserDirectorySetUserAttributesActionProcessor } from './getUserDirectorySetUserAttributesActionProcessor';\nimport { getUserDirectorySignOutUserActionProcessor } from './getUserDirectorySignOutUserActionProcessor';\n\nexport const getUserDirectoryActionProcessor: ActionProcessorListResolver = async (\n  qpqConfig: QPQConfig,\n  dynamicModuleLoader: DynamicModuleLoader,\n): Promise<ActionProcessorList> => ({\n  ...(await getUserDirectoryAssociateSoftwareTokenActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryAuthenticateUserActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryChangePasswordActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryConfirmEmailVerificationActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryConfirmForgotPasswordActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryCreateUserActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryDecodeAccessTokenActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryForgotPasswordActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryGetUserAttributesActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryGetUserAttributesByUserIdActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryGetUsersActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryGetUsersByAttributeActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryReadAccessTokenActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryRefreshTokenActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryRevokeRefreshTokenActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryRequestEmailVerificationActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectoryRespondToAuthChallengeActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectorySetAccessTokenActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectorySetPasswordActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectorySetUserAttributesActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getUserDirectorySignOutUserActionProcessor(qpqConfig, dynamicModuleLoader)),\n});\n"]}

package/lib/esm/logic/cognito/globalSignOut.d.ts

@@ -0,0 +1 @@
+export declare const globalSignOut: (accessToken: string, region: string) => Promise<void>;

package/lib/esm/logic/cognito/globalSignOut.js

@@ -0,0 +1,15 @@
+import { CognitoIdentityProviderClient, GlobalSignOutCommand } from '@aws-sdk/client-cognito-identity-provider';
+import { createAwsClient } from '../createAwsClient';
+// Revokes EVERY refresh token issued to the user who owns this access token. Authorized by
+// the access token itself (no IAM needed, like ChangePassword). Access tokens already minted
+// stay valid until they expire (stateless JWTs), so keep the access-token validity short.
+export const globalSignOut = async (accessToken, region) => {
+    const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {
+        region,
+    });
+    const params = {
+        AccessToken: accessToken,
+    };
+    await cognitoClient.send(new GlobalSignOutCommand(params));
+};
+//# sourceMappingURL=globalSignOut.js.map

package/lib/esm/logic/cognito/globalSignOut.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"globalSignOut.js","sourceRoot":"","sources":["../../../../src/logic/cognito/globalSignOut.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,oBAAoB,EAA6B,MAAM,2CAA2C,CAAC;AAE3I,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,2FAA2F;AAC3F,6FAA6F;AAC7F,0FAA0F;AAC1F,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,WAAmB,EAAE,MAAc,EAAiB,EAAE;IACxF,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,MAAM,GAA8B;QACxC,WAAW,EAAE,WAAW;KACzB,CAAC;IAEF,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7D,CAAC,CAAC","sourcesContent":["import { CognitoIdentityProviderClient, GlobalSignOutCommand, GlobalSignOutCommandInput } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\n\n// Revokes EVERY refresh token issued to the user who owns this access token. Authorized by\n// the access token itself (no IAM needed, like ChangePassword). Access tokens already minted\n// stay valid until they expire (stateless JWTs), so keep the access-token validity short.\nexport const globalSignOut = async (accessToken: string, region: string): Promise<void> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const params: GlobalSignOutCommandInput = {\n    AccessToken: accessToken,\n  };\n\n  await cognitoClient.send(new GlobalSignOutCommand(params));\n};\n"]}

package/lib/esm/logic/cognito/index.d.ts

@@ -1,2 +1,4 @@
 export * from './decodeAccessToken';
 export * from './decodeValidJwt';
+export * from './globalSignOut';
+export * from './revokeRefreshToken';

package/lib/esm/logic/cognito/index.js

@@ -1,3 +1,5 @@
 export * from './decodeAccessToken';
 export * from './decodeValidJwt';
+export * from './globalSignOut';
+export * from './revokeRefreshToken';
 //# sourceMappingURL=index.js.map

package/lib/esm/logic/cognito/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/logic/cognito/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC","sourcesContent":["export * from './decodeAccessToken';\nexport * from './decodeValidJwt';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/logic/cognito/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC","sourcesContent":["export * from './decodeAccessToken';\nexport * from './decodeValidJwt';\nexport * from './globalSignOut';\nexport * from './revokeRefreshToken';\n"]}

package/lib/esm/logic/cognito/refreshToken.js

@@ -21,6 +21,15 @@ export const refreshToken = async (userPoolId, clientId, region, username, refre
     // Time we issued the request
     const issueDateTime = new Date().toISOString();
     const response = await cognitoClient.send(new AdminInitiateAuthCommand(params));
-    return cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo(response, issueDateTime);
+    const authResponse = cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo(response, issueDateTime);
+    // Cognito's REFRESH_TOKEN_AUTH flow does NOT return a refresh token — the existing one stays
+    // valid and is reused — so AuthenticationResult.RefreshToken is undefined here. Carry the
+    // caller's refresh token forward so the client keeps a usable session; without this it's
+    // dropped after the first refresh and the session can never refresh again. (If refresh-token
+    // rotation is ever enabled, Cognito DOES return a new one — then we keep that instead.)
+    if (authResponse.authenticationInfo && !authResponse.authenticationInfo.refreshToken) {
+        authResponse.authenticationInfo.refreshToken = refreshToken;
+    }
+    return authResponse;
 };
 //# sourceMappingURL=refreshToken.js.map

package/lib/esm/logic/cognito/refreshToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"refreshToken.js","sourceRoot":"","sources":["../../../../src/logic/cognito/refreshToken.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,wBAAwB,EAExB,YAAY,EACZ,6BAA6B,GAC9B,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,uDAAuD,EAAE,MAAM,kCAAkC,CAAC;AAC3G,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,QAAgB,EAChB,YAAoB,EACe,EAAE;IACrC,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAkC;QAC5C,QAAQ,EAAE,YAAY,CAAC,kBAAkB;QACzC,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAElB,cAAc,EAAE;YACd,aAAa,EAAE,YAAY;YAC3B,WAAW,EAAE,UAAU;SACxB;KACF,CAAC;IAEF,6BAA6B;IAC7B,MAAM,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhF,OAAO,uDAAuD,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AAC1F,CAAC,CAAC","sourcesContent":["import { AuthenticateUserResponse } from 'quidproquo-core';\n\nimport {\n  AdminInitiateAuthCommand,\n  AdminInitiateAuthCommandInput,\n  AuthFlowType,\n  CognitoIdentityProviderClient,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo } from './utils/transformCognitoResponse';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\nexport const refreshToken = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  username: string,\n  refreshToken: string,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  const params: AdminInitiateAuthCommandInput = {\n    AuthFlow: AuthFlowType.REFRESH_TOKEN_AUTH,\n    UserPoolId: userPoolId,\n    ClientId: clientId,\n\n    AuthParameters: {\n      REFRESH_TOKEN: refreshToken,\n      SECRET_HASH: secretHash,\n    },\n  };\n\n  // Time we issued the request\n  const issueDateTime = new Date().toISOString();\n  const response = await cognitoClient.send(new AdminInitiateAuthCommand(params));\n\n  return cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo(response, issueDateTime);\n};\n"]}
+{"version":3,"file":"refreshToken.js","sourceRoot":"","sources":["../../../../src/logic/cognito/refreshToken.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,wBAAwB,EAExB,YAAY,EACZ,6BAA6B,GAC9B,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,uDAAuD,EAAE,MAAM,kCAAkC,CAAC;AAC3G,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,QAAgB,EAChB,YAAoB,EACe,EAAE;IACrC,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAkC;QAC5C,QAAQ,EAAE,YAAY,CAAC,kBAAkB;QACzC,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,QAAQ;QAElB,cAAc,EAAE;YACd,aAAa,EAAE,YAAY;YAC3B,WAAW,EAAE,UAAU;SACxB;KACF,CAAC;IAEF,6BAA6B;IAC7B,MAAM,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhF,MAAM,YAAY,GAAG,uDAAuD,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAEtG,6FAA6F;IAC7F,0FAA0F;IAC1F,yFAAyF;IACzF,6FAA6F;IAC7F,wFAAwF;IACxF,IAAI,YAAY,CAAC,kBAAkB,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,YAAY,EAAE,CAAC;QACrF,YAAY,CAAC,kBAAkB,CAAC,YAAY,GAAG,YAAY,CAAC;IAC9D,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC,CAAC","sourcesContent":["import { AuthenticateUserResponse } from 'quidproquo-core';\n\nimport {\n  AdminInitiateAuthCommand,\n  AdminInitiateAuthCommandInput,\n  AuthFlowType,\n  CognitoIdentityProviderClient,\n} from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { calculateSecretHash } from './utils/calculateSecretHash';\nimport { cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo } from './utils/transformCognitoResponse';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\nexport const refreshToken = async (\n  userPoolId: string,\n  clientId: string,\n  region: string,\n  username: string,\n  refreshToken: string,\n): Promise<AuthenticateUserResponse> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n  const secretHash = calculateSecretHash(username, clientId, clientSecret);\n\n  const params: AdminInitiateAuthCommandInput = {\n    AuthFlow: AuthFlowType.REFRESH_TOKEN_AUTH,\n    UserPoolId: userPoolId,\n    ClientId: clientId,\n\n    AuthParameters: {\n      REFRESH_TOKEN: refreshToken,\n      SECRET_HASH: secretHash,\n    },\n  };\n\n  // Time we issued the request\n  const issueDateTime = new Date().toISOString();\n  const response = await cognitoClient.send(new AdminInitiateAuthCommand(params));\n\n  const authResponse = cognitoAdminInitiateAuthResponseToQpqAuthenticationInfo(response, issueDateTime);\n\n  // Cognito's REFRESH_TOKEN_AUTH flow does NOT return a refresh token — the existing one stays\n  // valid and is reused — so AuthenticationResult.RefreshToken is undefined here. Carry the\n  // caller's refresh token forward so the client keeps a usable session; without this it's\n  // dropped after the first refresh and the session can never refresh again. (If refresh-token\n  // rotation is ever enabled, Cognito DOES return a new one — then we keep that instead.)\n  if (authResponse.authenticationInfo && !authResponse.authenticationInfo.refreshToken) {\n    authResponse.authenticationInfo.refreshToken = refreshToken;\n  }\n\n  return authResponse;\n};\n"]}

package/lib/esm/logic/cognito/revokeRefreshToken.d.ts

@@ -0,0 +1 @@
+export declare const revokeRefreshToken: (userPoolId: string, clientId: string, region: string, refreshToken: string) => Promise<void>;

package/lib/esm/logic/cognito/revokeRefreshToken.js

@@ -0,0 +1,20 @@
+import { CognitoIdentityProviderClient, RevokeTokenCommand } from '@aws-sdk/client-cognito-identity-provider';
+import { createAwsClient } from '../createAwsClient';
+import { getUserPoolClientSecret } from './getUserPoolClientSecret';
+// Revokes a single refresh token (and its access-token lineage) via Cognito RevokeToken.
+// The app client has a secret (same one the refresh flow uses), so it must be supplied.
+// Requires token revocation to be enabled on the app client (the CDK default) — a disabled
+// client surfaces as UnsupportedOperationException/UnsupportedTokenTypeException.
+export const revokeRefreshToken = async (userPoolId, clientId, region, refreshToken) => {
+    const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {
+        region,
+    });
+    const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);
+    const params = {
+        Token: refreshToken,
+        ClientId: clientId,
+        ClientSecret: clientSecret,
+    };
+    await cognitoClient.send(new RevokeTokenCommand(params));
+};
+//# sourceMappingURL=revokeRefreshToken.js.map

package/lib/esm/logic/cognito/revokeRefreshToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revokeRefreshToken.js","sourceRoot":"","sources":["../../../../src/logic/cognito/revokeRefreshToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,kBAAkB,EAA2B,MAAM,2CAA2C,CAAC;AAEvI,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,yFAAyF;AACzF,wFAAwF;AACxF,2FAA2F;AAC3F,kFAAkF;AAClF,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EAAE,UAAkB,EAAE,QAAgB,EAAE,MAAc,EAAE,YAAoB,EAAiB,EAAE;IACpI,MAAM,aAAa,GAAG,eAAe,CAAC,6BAA6B,EAAE;QACnE,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAEjF,MAAM,MAAM,GAA4B;QACtC,KAAK,EAAE,YAAY;QACnB,QAAQ,EAAE,QAAQ;QAClB,YAAY,EAAE,YAAY;KAC3B,CAAC;IAEF,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3D,CAAC,CAAC","sourcesContent":["import { CognitoIdentityProviderClient, RevokeTokenCommand, RevokeTokenCommandInput } from '@aws-sdk/client-cognito-identity-provider';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { getUserPoolClientSecret } from './getUserPoolClientSecret';\n\n// Revokes a single refresh token (and its access-token lineage) via Cognito RevokeToken.\n// The app client has a secret (same one the refresh flow uses), so it must be supplied.\n// Requires token revocation to be enabled on the app client (the CDK default) — a disabled\n// client surfaces as UnsupportedOperationException/UnsupportedTokenTypeException.\nexport const revokeRefreshToken = async (userPoolId: string, clientId: string, region: string, refreshToken: string): Promise<void> => {\n  const cognitoClient = createAwsClient(CognitoIdentityProviderClient, {\n    region,\n  });\n\n  const clientSecret = await getUserPoolClientSecret(userPoolId, clientId, region);\n\n  const params: RevokeTokenCommandInput = {\n    Token: refreshToken,\n    ClientId: clientId,\n    ClientSecret: clientSecret,\n  };\n\n  await cognitoClient.send(new RevokeTokenCommand(params));\n};\n"]}

package/lib/esm/logic/s3/generatePresignedUploadUrl.d.ts

@@ -1 +1 @@
-export declare const generatePresignedUploadUrl: (bucketName: string, objectKey: string, region: string, expirationMs: number, correlationId?: string, contentType?: string) => Promise<string>;
+export declare const generatePresignedUploadUrl: (bucketName: string, objectKey: string, region: string, expirationMs: number, correlationId?: string, contentType?: string, contentDisposition?: string) => Promise<string>;

package/lib/esm/logic/s3/generatePresignedUploadUrl.js

@@ -31,7 +31,7 @@ import { createAwsClient } from '../createAwsClient';
 //     fields: presignedPost.fields
 //   };
 // };
-export const generatePresignedUploadUrl = async (bucketName, objectKey, region, expirationMs, correlationId, contentType) => {
+export const generatePresignedUploadUrl = async (bucketName, objectKey, region, expirationMs, correlationId, contentType, contentDisposition) => {
     // WHEN_REQUIRED disables the SDK v3 default request checksum (CRC32). Otherwise the
     // presigner bakes an empty-body checksum (x-amz-checksum-crc32=AAAAAA==) into the signed
     // URL, which never matches the real body the browser PUTs — S3 then rejects the upload and
@@ -44,6 +44,9 @@ export const generatePresignedUploadUrl = async (bucketName, objectKey, region,
         Bucket: bucketName,
         Key: objectKey,
         ContentType: contentType,
+        // Signed into the URL: the client's PUT must send the matching Content-Disposition header, and
+        // S3 stores it so later GETs serve it back (e.g. 'inline' to preview a PDF instead of downloading).
+        ContentDisposition: contentDisposition,
         Metadata: {
             ...(correlationId && { 'correlation-id': correlationId }),
             'upload-timestamp': Date.now().toString(),

package/lib/esm/logic/s3/generatePresignedUploadUrl.js.map

@@ -1 +1 @@
-{"version":3,"file":"generatePresignedUploadUrl.js","sourceRoot":"","sources":["../../../../src/logic/s3/generatePresignedUploadUrl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAE7D,oEAAoE;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,wDAAwD;AACxD,wBAAwB;AACxB,uBAAuB;AACvB,oBAAoB;AACpB,0BAA0B;AAC1B,qCAAqC;AACrC,sCAAsC;AACtC,mEAAmE;AACnE,4DAA4D;AAE5D,kCAAkC;AAElC,8CAA8C;AAC9C,uBAAuB;AACvB,6DAA6D;AAC7D,MAAM;AAEN,iDAAiD;AACjD,wBAAwB;AACxB,kEAAkE;AAClE,MAAM;AAEN,gEAAgE;AAChE,0BAA0B;AAC1B,sBAAsB;AACtB,8BAA8B;AAC9B,gDAAgD;AAChD,QAAQ;AAER,aAAa;AACb,8BAA8B;AAC9B,mCAAmC;AACnC,OAAO;AACP,KAAK;AAEL,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,EAC7C,UAAkB,EAClB,SAAiB,EACjB,MAAc,EACd,YAAoB,EACpB,aAAsB,EACtB,WAAoB,EACH,EAAE;IACnB,oFAAoF;IACpF,yFAAyF;IACzF,2FAA2F;IAC3F,+FAA+F;IAC/F,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE;QACzC,MAAM;QACN,0BAA0B,EAAE,eAAe;KAC5C,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC;QAC5C,MAAM,EAAE,UAAU;QAClB,GAAG,EAAE,SAAS;QACd,WAAW,EAAE,WAAW;QAExB,QAAQ,EAAE;YACR,GAAG,CAAC,aAAa,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC;YACzD,kBAAkB,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;SAC1C;KACF,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,gBAAgB,EAAE;QACzD,SAAS,EAAE,YAAY,GAAG,IAAI;KAC/B,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC,CAAC","sourcesContent":["import { PutObjectCommand, S3Client } from '@aws-sdk/client-s3';\nimport { getSignedUrl } from '@aws-sdk/s3-request-presigner';\n\n// import { createPresignedPost } from '@aws-sdk/s3-presigned-post';\nimport { createAwsClient } from '../createAwsClient';\n\n// export const generatePresignedUploadFormUrl = async (\n//   bucketName: string,\n//   objectKey: string,\n//   region: string,\n//   expirationMs: number,\n//   contentType: string | undefined,\n//   maxSizeBytes?: number | undefined\n// ): Promise<{ url: string; fields: Record<string, string> }> => {\n//   const s3Client = createAwsClient(S3Client, { region });\n\n//   const conditions: any[] = [];\n\n//   // Add content type condition if provided\n//   if (contentType) {\n//     conditions.push(['eq', '$Content-Type', contentType]);\n//   }\n\n//   // Add file size limit condition if provided\n//   if (maxSizeBytes) {\n//     conditions.push(['content-length-range', 0, maxSizeBytes]);\n//   }\n\n//   const presignedPost = await createPresignedPost(s3Client, {\n//     Bucket: bucketName,\n//     Key: objectKey,\n//     Conditions: conditions,\n//     Expires: Math.floor(expirationMs / 1000),\n//   });\n\n//   return {\n//     url: presignedPost.url,\n//     fields: presignedPost.fields\n//   };\n// };\n\nexport const generatePresignedUploadUrl = async (\n  bucketName: string,\n  objectKey: string,\n  region: string,\n  expirationMs: number,\n  correlationId?: string,\n  contentType?: string,\n): Promise<string> => {\n  // WHEN_REQUIRED disables the SDK v3 default request checksum (CRC32). Otherwise the\n  // presigner bakes an empty-body checksum (x-amz-checksum-crc32=AAAAAA==) into the signed\n  // URL, which never matches the real body the browser PUTs — S3 then rejects the upload and\n  // the failure surfaces in the browser as a CORS error (the error response has no ACAO header).\n  const s3Client = createAwsClient(S3Client, {\n    region,\n    requestChecksumCalculation: 'WHEN_REQUIRED',\n  });\n\n  const putObjectCommand = new PutObjectCommand({\n    Bucket: bucketName,\n    Key: objectKey,\n    ContentType: contentType,\n\n    Metadata: {\n      ...(correlationId && { 'correlation-id': correlationId }),\n      'upload-timestamp': Date.now().toString(),\n    },\n  });\n\n  const url = await getSignedUrl(s3Client, putObjectCommand, {\n    expiresIn: expirationMs / 1000,\n  });\n\n  return url;\n};\n"]}
+{"version":3,"file":"generatePresignedUploadUrl.js","sourceRoot":"","sources":["../../../../src/logic/s3/generatePresignedUploadUrl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAE7D,oEAAoE;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,wDAAwD;AACxD,wBAAwB;AACxB,uBAAuB;AACvB,oBAAoB;AACpB,0BAA0B;AAC1B,qCAAqC;AACrC,sCAAsC;AACtC,mEAAmE;AACnE,4DAA4D;AAE5D,kCAAkC;AAElC,8CAA8C;AAC9C,uBAAuB;AACvB,6DAA6D;AAC7D,MAAM;AAEN,iDAAiD;AACjD,wBAAwB;AACxB,kEAAkE;AAClE,MAAM;AAEN,gEAAgE;AAChE,0BAA0B;AAC1B,sBAAsB;AACtB,8BAA8B;AAC9B,gDAAgD;AAChD,QAAQ;AAER,aAAa;AACb,8BAA8B;AAC9B,mCAAmC;AACnC,OAAO;AACP,KAAK;AAEL,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,EAC7C,UAAkB,EAClB,SAAiB,EACjB,MAAc,EACd,YAAoB,EACpB,aAAsB,EACtB,WAAoB,EACpB,kBAA2B,EACV,EAAE;IACnB,oFAAoF;IACpF,yFAAyF;IACzF,2FAA2F;IAC3F,+FAA+F;IAC/F,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE;QACzC,MAAM;QACN,0BAA0B,EAAE,eAAe;KAC5C,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC;QAC5C,MAAM,EAAE,UAAU;QAClB,GAAG,EAAE,SAAS;QACd,WAAW,EAAE,WAAW;QACxB,+FAA+F;QAC/F,oGAAoG;QACpG,kBAAkB,EAAE,kBAAkB;QAEtC,QAAQ,EAAE;YACR,GAAG,CAAC,aAAa,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC;YACzD,kBAAkB,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;SAC1C;KACF,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,gBAAgB,EAAE;QACzD,SAAS,EAAE,YAAY,GAAG,IAAI;KAC/B,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC,CAAC","sourcesContent":["import { PutObjectCommand, S3Client } from '@aws-sdk/client-s3';\nimport { getSignedUrl } from '@aws-sdk/s3-request-presigner';\n\n// import { createPresignedPost } from '@aws-sdk/s3-presigned-post';\nimport { createAwsClient } from '../createAwsClient';\n\n// export const generatePresignedUploadFormUrl = async (\n//   bucketName: string,\n//   objectKey: string,\n//   region: string,\n//   expirationMs: number,\n//   contentType: string | undefined,\n//   maxSizeBytes?: number | undefined\n// ): Promise<{ url: string; fields: Record<string, string> }> => {\n//   const s3Client = createAwsClient(S3Client, { region });\n\n//   const conditions: any[] = [];\n\n//   // Add content type condition if provided\n//   if (contentType) {\n//     conditions.push(['eq', '$Content-Type', contentType]);\n//   }\n\n//   // Add file size limit condition if provided\n//   if (maxSizeBytes) {\n//     conditions.push(['content-length-range', 0, maxSizeBytes]);\n//   }\n\n//   const presignedPost = await createPresignedPost(s3Client, {\n//     Bucket: bucketName,\n//     Key: objectKey,\n//     Conditions: conditions,\n//     Expires: Math.floor(expirationMs / 1000),\n//   });\n\n//   return {\n//     url: presignedPost.url,\n//     fields: presignedPost.fields\n//   };\n// };\n\nexport const generatePresignedUploadUrl = async (\n  bucketName: string,\n  objectKey: string,\n  region: string,\n  expirationMs: number,\n  correlationId?: string,\n  contentType?: string,\n  contentDisposition?: string,\n): Promise<string> => {\n  // WHEN_REQUIRED disables the SDK v3 default request checksum (CRC32). Otherwise the\n  // presigner bakes an empty-body checksum (x-amz-checksum-crc32=AAAAAA==) into the signed\n  // URL, which never matches the real body the browser PUTs — S3 then rejects the upload and\n  // the failure surfaces in the browser as a CORS error (the error response has no ACAO header).\n  const s3Client = createAwsClient(S3Client, {\n    region,\n    requestChecksumCalculation: 'WHEN_REQUIRED',\n  });\n\n  const putObjectCommand = new PutObjectCommand({\n    Bucket: bucketName,\n    Key: objectKey,\n    ContentType: contentType,\n    // Signed into the URL: the client's PUT must send the matching Content-Disposition header, and\n    // S3 stores it so later GETs serve it back (e.g. 'inline' to preview a PDF instead of downloading).\n    ContentDisposition: contentDisposition,\n\n    Metadata: {\n      ...(correlationId && { 'correlation-id': correlationId }),\n      'upload-timestamp': Date.now().toString(),\n    },\n  });\n\n  const url = await getSignedUrl(s3Client, putObjectCommand, {\n    expiresIn: expirationMs / 1000,\n  });\n\n  return url;\n};\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "quidproquo-actionprocessor-awslambda",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "",
   "main": "./lib/commonjs/index.js",
   "module": "./lib/esm/index.js",
@@ -60,11 +60,11 @@
     "lodash": "^4.17.21",
     "node-cache": "^5.1.2",
     "node-match-path": "^0.6.3",
-    "quidproquo-actionprocessor-js": "0.1.8",
-    "quidproquo-actionprocessor-node": "0.1.8",
-    "quidproquo-config-aws": "0.1.8",
-    "quidproquo-core": "0.1.8",
-    "quidproquo-webserver": "0.1.8"
+    "quidproquo-actionprocessor-js": "0.1.10",
+    "quidproquo-actionprocessor-node": "0.1.10",
+    "quidproquo-config-aws": "0.1.10",
+    "quidproquo-core": "0.1.10",
+    "quidproquo-webserver": "0.1.10"
   },
   "devDependencies": {
     "@types/busboy": "^1.5.0",
@@ -72,7 +72,7 @@
     "@types/lodash": "^4.14.194",
     "@types/node": "^22.13.13",
     "esbuild": "^0.25.8",
-    "quidproquo-tsconfig": "0.1.8",
+    "quidproquo-tsconfig": "0.1.10",
     "typescript": "^5.8.2"
   }
 }