ts-ag 1.2.2 → 1.2.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.mts +3 -2
- package/dist/index.d.mts.map +1 -1
- package/dist/index.mjs +255 -240
- package/dist/index.mjs.map +1 -1
- package/dist/worker.d.mts +3 -2
- package/dist/worker.d.mts.map +1 -1
- package/dist/worker.mjs +255 -240
- package/dist/worker.mjs.map +1 -1
- package/package.json +9 -4
package/dist/worker.mjs
CHANGED
|
@@ -254,19 +254,20 @@ function response_ok(body, headers, cookies) {
|
|
|
254
254
|
}
|
|
255
255
|
//#endregion
|
|
256
256
|
//#region src/lambda/server/authentication.ts
|
|
257
|
+
const getCookiesResult = /* @__PURE__ */ Result.fromThrowable((event) => {
|
|
258
|
+
if (!("headers" in event) || !event.headers) throw new Error("No headers in event");
|
|
259
|
+
const cookieString = Array.isArray(event.cookies) && event.cookies.length > 0 ? event.cookies.join("; ") : event.headers.Cookie || event.headers.cookie;
|
|
260
|
+
if (!cookieString) throw new Error("No cookies found in event");
|
|
261
|
+
return parse$2(cookieString);
|
|
262
|
+
}, (e) => {
|
|
263
|
+
if (e instanceof Error) return error_lambda_unauthorized(e.message);
|
|
264
|
+
return error_lambda_unauthorized("Invalid Cookies");
|
|
265
|
+
});
|
|
257
266
|
/**
|
|
258
267
|
* Wraps cookies parse along with the api gateway event with neverthrow
|
|
259
268
|
*/
|
|
260
269
|
function getCookies(event) {
|
|
261
|
-
return
|
|
262
|
-
if (!("headers" in event) || !event.headers) throw new Error("No headers in event");
|
|
263
|
-
const cookieString = Array.isArray(event.cookies) && event.cookies.length > 0 ? event.cookies.join("; ") : event.headers.Cookie || event.headers.cookie;
|
|
264
|
-
if (!cookieString) throw new Error("No cookies found in event");
|
|
265
|
-
return parse$2(cookieString);
|
|
266
|
-
}, (e) => {
|
|
267
|
-
if (e instanceof Error) return error_lambda_unauthorized(e.message);
|
|
268
|
-
return error_lambda_unauthorized("Invalid Cookies");
|
|
269
|
-
})();
|
|
270
|
+
return getCookiesResult(event);
|
|
270
271
|
}
|
|
271
272
|
//#endregion
|
|
272
273
|
//#region src/cognito/client.ts
|
|
@@ -459,24 +460,35 @@ function isRecord$2(value) {
|
|
|
459
460
|
}
|
|
460
461
|
//#endregion
|
|
461
462
|
//#region src/cognito/user.ts
|
|
463
|
+
const getUserDetailsResult = /* @__PURE__ */ ResultAsync.fromThrowable(async (a) => {
|
|
464
|
+
console.log("getUserDetails: Getting details for user: ", a.username);
|
|
465
|
+
const res = await getCognitoClient().send(new AdminGetUserCommand({
|
|
466
|
+
UserPoolId: a.userPoolId,
|
|
467
|
+
Username: a.username
|
|
468
|
+
}));
|
|
469
|
+
return {
|
|
470
|
+
...res,
|
|
471
|
+
UserAttributes: extractAttributes(res.UserAttributes)
|
|
472
|
+
};
|
|
473
|
+
}, (e) => {
|
|
474
|
+
console.error("getUserDetails:error:", e);
|
|
475
|
+
return error_cognito(e);
|
|
476
|
+
});
|
|
477
|
+
const getUserGroupsResult = /* @__PURE__ */ ResultAsync.fromThrowable(async (a) => {
|
|
478
|
+
console.log("getUserGroups: Getting groups for user: ", a.username);
|
|
479
|
+
return getCognitoClient().send(new AdminListGroupsForUserCommand({
|
|
480
|
+
UserPoolId: a.userPoolId,
|
|
481
|
+
Username: a.username
|
|
482
|
+
}));
|
|
483
|
+
}, (e) => {
|
|
484
|
+
console.error("getUserGroups:error:", e);
|
|
485
|
+
return error_cognito(e);
|
|
486
|
+
});
|
|
462
487
|
/**
|
|
463
488
|
* Performs an AdminGetUserCommand and extracts the user attributes into an object
|
|
464
489
|
*/
|
|
465
490
|
function getUserDetails(a) {
|
|
466
|
-
return
|
|
467
|
-
console.log("getUserDetails: Getting details for user: ", a.username);
|
|
468
|
-
const res = await getCognitoClient().send(new AdminGetUserCommand({
|
|
469
|
-
UserPoolId: a.userPoolId,
|
|
470
|
-
Username: a.username
|
|
471
|
-
}));
|
|
472
|
-
return {
|
|
473
|
-
...res,
|
|
474
|
-
UserAttributes: extractAttributes(res.UserAttributes)
|
|
475
|
-
};
|
|
476
|
-
}, (e) => {
|
|
477
|
-
console.error("getUserDetails:error:", e);
|
|
478
|
-
return error_cognito(e);
|
|
479
|
-
})();
|
|
491
|
+
return getUserDetailsResult(a);
|
|
480
492
|
}
|
|
481
493
|
/**
|
|
482
494
|
* @returns An object of attributes with their names as keys and values as values.
|
|
@@ -492,19 +504,178 @@ function extractAttributes(attrs) {
|
|
|
492
504
|
* Performs an AdminGetUserCommand and extracts the user attributes into an object
|
|
493
505
|
*/
|
|
494
506
|
function getUserGroups(a) {
|
|
495
|
-
return
|
|
496
|
-
console.log("getUserGroups: Getting groups for user: ", a.username);
|
|
497
|
-
return await getCognitoClient().send(new AdminListGroupsForUserCommand({
|
|
498
|
-
UserPoolId: a.userPoolId,
|
|
499
|
-
Username: a.username
|
|
500
|
-
}));
|
|
501
|
-
}, (e) => {
|
|
502
|
-
console.error("getUserGroups:error:", e);
|
|
503
|
-
return error_cognito(e);
|
|
504
|
-
})();
|
|
507
|
+
return getUserGroupsResult(a);
|
|
505
508
|
}
|
|
506
509
|
//#endregion
|
|
507
510
|
//#region src/cognito/password.ts
|
|
511
|
+
const changePasswordResult = /* @__PURE__ */ ResultAsync.fromThrowable(async (accessToken, oldPassword, newPassword) => {
|
|
512
|
+
return getCognitoClient().send(new ChangePasswordCommand({
|
|
513
|
+
AccessToken: accessToken,
|
|
514
|
+
PreviousPassword: oldPassword,
|
|
515
|
+
ProposedPassword: newPassword
|
|
516
|
+
}));
|
|
517
|
+
}, (e) => {
|
|
518
|
+
console.error("ChangePasswordCommand error", e);
|
|
519
|
+
return error_cognito(e);
|
|
520
|
+
});
|
|
521
|
+
const confirmForgotPasswordResult = /* @__PURE__ */ ResultAsync.fromThrowable((a) => {
|
|
522
|
+
return getCognitoClient().send(new ConfirmForgotPasswordCommand({
|
|
523
|
+
ClientId: a.clientId,
|
|
524
|
+
Username: a.username,
|
|
525
|
+
ConfirmationCode: a.confirmationCode,
|
|
526
|
+
Password: a.newPassword,
|
|
527
|
+
SecretHash: computeSecretHash(a.username, a.clientId, a.clientSecret)
|
|
528
|
+
}));
|
|
529
|
+
}, (e) => {
|
|
530
|
+
console.error("ConfirmForgotPasswordCommand error", e);
|
|
531
|
+
return error_cognito(e);
|
|
532
|
+
});
|
|
533
|
+
const confirmSignupResult = /* @__PURE__ */ ResultAsync.fromThrowable((a) => {
|
|
534
|
+
return getCognitoClient().send(new ConfirmSignUpCommand({
|
|
535
|
+
ClientId: a.clientId,
|
|
536
|
+
Username: a.username,
|
|
537
|
+
ConfirmationCode: a.confirmationCode,
|
|
538
|
+
SecretHash: computeSecretHash(a.username, a.clientId, a.clientSecret)
|
|
539
|
+
}));
|
|
540
|
+
}, (e) => {
|
|
541
|
+
console.error("ConfirmSignUpCommand error", e);
|
|
542
|
+
return error_cognito(e);
|
|
543
|
+
});
|
|
544
|
+
const forgotPasswordResult = /* @__PURE__ */ ResultAsync.fromThrowable((a) => {
|
|
545
|
+
return getCognitoClient().send(new ForgotPasswordCommand({
|
|
546
|
+
ClientId: a.clientId,
|
|
547
|
+
Username: a.username,
|
|
548
|
+
SecretHash: computeSecretHash(a.username, a.clientId, a.clientSecret)
|
|
549
|
+
}));
|
|
550
|
+
}, (e) => {
|
|
551
|
+
console.error("ForgotPasswordCommand error", e);
|
|
552
|
+
return error_cognito(e);
|
|
553
|
+
});
|
|
554
|
+
const loginResult = /* @__PURE__ */ ResultAsync.fromThrowable((a) => {
|
|
555
|
+
return getCognitoClient().send(new AdminInitiateAuthCommand({
|
|
556
|
+
AuthFlow: "ADMIN_USER_PASSWORD_AUTH",
|
|
557
|
+
ClientId: a.clientId,
|
|
558
|
+
UserPoolId: a.userPoolId,
|
|
559
|
+
AuthParameters: {
|
|
560
|
+
USERNAME: a.username,
|
|
561
|
+
PASSWORD: a.password,
|
|
562
|
+
SECRET_HASH: computeSecretHash(a.username, a.clientId, a.clientSecret)
|
|
563
|
+
}
|
|
564
|
+
}));
|
|
565
|
+
}, (e) => {
|
|
566
|
+
console.error("AdminInitiateAuthCommand error", e);
|
|
567
|
+
return error_cognito(e);
|
|
568
|
+
});
|
|
569
|
+
const refreshTokensResult = /* @__PURE__ */ ResultAsync.fromThrowable((a) => {
|
|
570
|
+
return getCognitoClient().send(new GetTokensFromRefreshTokenCommand(a));
|
|
571
|
+
}, (e) => {
|
|
572
|
+
console.error("refreshTokens: GetTokensFromRefreshTokenCommand error", e);
|
|
573
|
+
return error_cognito(e);
|
|
574
|
+
});
|
|
575
|
+
const refreshTokensAuthResult = /* @__PURE__ */ ResultAsync.fromThrowable((a) => {
|
|
576
|
+
return getCognitoClient().send(new AdminInitiateAuthCommand({
|
|
577
|
+
AuthFlow: "REFRESH_TOKEN_AUTH",
|
|
578
|
+
ClientId: a.clientId,
|
|
579
|
+
UserPoolId: a.userPoolId,
|
|
580
|
+
AuthParameters: {
|
|
581
|
+
REFRESH_TOKEN: a.refreshToken,
|
|
582
|
+
SECRET_HASH: computeSecretHash(a.username, a.clientId, a.clientSecret)
|
|
583
|
+
}
|
|
584
|
+
}));
|
|
585
|
+
}, (e) => {
|
|
586
|
+
console.error("refreshTokens: AdminInitiateAuthCommand error", e);
|
|
587
|
+
return error_cognito(e);
|
|
588
|
+
});
|
|
589
|
+
const logoutResult = /* @__PURE__ */ ResultAsync.fromThrowable((accessToken) => {
|
|
590
|
+
return getCognitoClient().send(new GlobalSignOutCommand({ AccessToken: accessToken }));
|
|
591
|
+
}, (e) => {
|
|
592
|
+
console.error("GlobalSignOutCommand error", e);
|
|
593
|
+
return error_cognito(e);
|
|
594
|
+
});
|
|
595
|
+
const resetPasswordResult = /* @__PURE__ */ ResultAsync.fromThrowable((a) => {
|
|
596
|
+
return getCognitoClient().send(new RespondToAuthChallengeCommand({
|
|
597
|
+
ChallengeName: "NEW_PASSWORD_REQUIRED",
|
|
598
|
+
ClientId: a.clientId,
|
|
599
|
+
Session: a.session,
|
|
600
|
+
ChallengeResponses: {
|
|
601
|
+
SECRET_HASH: computeSecretHash(a.username, a.clientId, a.clientSecret),
|
|
602
|
+
NEW_PASSWORD: a.newPassword,
|
|
603
|
+
USERNAME: a.username
|
|
604
|
+
}
|
|
605
|
+
}));
|
|
606
|
+
}, (e) => {
|
|
607
|
+
console.error("RespondToAuthChallengeCommand error", e);
|
|
608
|
+
return error_cognito(e);
|
|
609
|
+
});
|
|
610
|
+
const signUpResult = /* @__PURE__ */ ResultAsync.fromThrowable((a) => {
|
|
611
|
+
const cognitoClient = getCognitoClient();
|
|
612
|
+
const secretHash = computeSecretHash(a.username, a.clientId, a.clientSecret);
|
|
613
|
+
return cognitoClient.send(new SignUpCommand({
|
|
614
|
+
ClientId: a.clientId,
|
|
615
|
+
Username: a.username,
|
|
616
|
+
Password: a.password,
|
|
617
|
+
SecretHash: secretHash,
|
|
618
|
+
UserAttributes: Object.entries(a).filter(([key]) => ![
|
|
619
|
+
"username",
|
|
620
|
+
"password",
|
|
621
|
+
"clientId",
|
|
622
|
+
"clientSecret"
|
|
623
|
+
].includes(key)).map(([key, value]) => ({
|
|
624
|
+
Name: key,
|
|
625
|
+
Value: value
|
|
626
|
+
}))
|
|
627
|
+
}));
|
|
628
|
+
}, (e) => {
|
|
629
|
+
console.error("SignUpCommand error", e);
|
|
630
|
+
return error_cognito(e);
|
|
631
|
+
});
|
|
632
|
+
const verifyOAuthTokenResult = /* @__PURE__ */ ResultAsync.fromThrowable(async (a) => {
|
|
633
|
+
const basicAuth = Buffer.from(`${a.clientId}:${a.clientSecret}`).toString("base64");
|
|
634
|
+
const params = new URLSearchParams();
|
|
635
|
+
params.append("grant_type", "authorization_code");
|
|
636
|
+
params.append("code", a.code);
|
|
637
|
+
params.append("redirect_uri", a.redirectUri);
|
|
638
|
+
console.log("verifyOAuthToken: params", params.toString());
|
|
639
|
+
const tokenRes = await fetch(`https://${a.cognitoDomain}/oauth2/token`, {
|
|
640
|
+
method: "POST",
|
|
641
|
+
headers: {
|
|
642
|
+
"Content-Type": "application/x-www-form-urlencoded",
|
|
643
|
+
Authorization: `Basic ${basicAuth}`
|
|
644
|
+
},
|
|
645
|
+
body: params.toString()
|
|
646
|
+
});
|
|
647
|
+
if (!tokenRes.ok) {
|
|
648
|
+
console.error("verifyOAuthToken: token exchange failed", await tokenRes.text());
|
|
649
|
+
throw Object.assign(/* @__PURE__ */ new Error("OAuth token exchange failed"), { name: "NotAuthorizedException" });
|
|
650
|
+
}
|
|
651
|
+
return await tokenRes.json();
|
|
652
|
+
}, (e) => {
|
|
653
|
+
console.error("verifyOAuthToken:error", e);
|
|
654
|
+
return error_cognito(e);
|
|
655
|
+
});
|
|
656
|
+
const refreshOAuthTokenResult = /* @__PURE__ */ ResultAsync.fromThrowable(async (a) => {
|
|
657
|
+
const basicAuth = Buffer.from(`${a.clientId}:${a.clientSecret}`).toString("base64");
|
|
658
|
+
const params = new URLSearchParams();
|
|
659
|
+
params.append("grant_type", "refresh_token");
|
|
660
|
+
params.append("refresh_token", a.refreshToken);
|
|
661
|
+
console.log("refreshOAuthToken: params", params.toString());
|
|
662
|
+
const tokenRes = await fetch(`https://${a.cognitoDomain}/oauth2/token`, {
|
|
663
|
+
method: "POST",
|
|
664
|
+
headers: {
|
|
665
|
+
"Content-Type": "application/x-www-form-urlencoded",
|
|
666
|
+
Authorization: `Basic ${basicAuth}`
|
|
667
|
+
},
|
|
668
|
+
body: params.toString()
|
|
669
|
+
});
|
|
670
|
+
if (!tokenRes.ok) {
|
|
671
|
+
console.error("refreshOAuthToken: token exchange failed", await tokenRes.text());
|
|
672
|
+
throw Object.assign(/* @__PURE__ */ new Error("OAuth token refresh failed"), { name: "NotAuthorizedException" });
|
|
673
|
+
}
|
|
674
|
+
return await tokenRes.json();
|
|
675
|
+
}, (e) => {
|
|
676
|
+
console.error("refreshOAuthToken:error", e);
|
|
677
|
+
return error_cognito(e);
|
|
678
|
+
});
|
|
508
679
|
/**
|
|
509
680
|
* Computes Cognito secret hash used for client-side authentication flows.
|
|
510
681
|
*
|
|
@@ -524,16 +695,7 @@ function computeSecretHash(username, clientId, clientSecret) {
|
|
|
524
695
|
* @param newPassword - New password to set.
|
|
525
696
|
*/
|
|
526
697
|
function changePassword(accessToken, oldPassword, newPassword) {
|
|
527
|
-
return
|
|
528
|
-
return getCognitoClient().send(new ChangePasswordCommand({
|
|
529
|
-
AccessToken: accessToken,
|
|
530
|
-
PreviousPassword: oldPassword,
|
|
531
|
-
ProposedPassword: newPassword
|
|
532
|
-
}));
|
|
533
|
-
}, (e) => {
|
|
534
|
-
console.error("ChangePasswordCommand error", e);
|
|
535
|
-
return error_cognito(e);
|
|
536
|
-
})();
|
|
698
|
+
return changePasswordResult(accessToken, oldPassword, newPassword);
|
|
537
699
|
}
|
|
538
700
|
/**
|
|
539
701
|
* Completes a forgot-password flow by submitting the confirmation code and new password.
|
|
@@ -545,18 +707,7 @@ function changePassword(accessToken, oldPassword, newPassword) {
|
|
|
545
707
|
* @param a.clientSecret - Cognito app client secret.
|
|
546
708
|
*/
|
|
547
709
|
function confirmForgotPassword(a) {
|
|
548
|
-
return
|
|
549
|
-
return getCognitoClient().send(new ConfirmForgotPasswordCommand({
|
|
550
|
-
ClientId: a.clientId,
|
|
551
|
-
Username: a.username,
|
|
552
|
-
ConfirmationCode: a.confirmationCode,
|
|
553
|
-
Password: a.newPassword,
|
|
554
|
-
SecretHash: computeSecretHash(a.username, a.clientId, a.clientSecret)
|
|
555
|
-
}));
|
|
556
|
-
}, (e) => {
|
|
557
|
-
console.error("ConfirmForgotPasswordCommand error", e);
|
|
558
|
-
return error_cognito(e);
|
|
559
|
-
})();
|
|
710
|
+
return confirmForgotPasswordResult(a);
|
|
560
711
|
}
|
|
561
712
|
/**
|
|
562
713
|
* Confirms a user's signup using the confirmation code sent by Cognito.
|
|
@@ -567,17 +718,7 @@ function confirmForgotPassword(a) {
|
|
|
567
718
|
* @param a.clientSecret - Cognito app client secret.
|
|
568
719
|
*/
|
|
569
720
|
function confirmSignup(a) {
|
|
570
|
-
return
|
|
571
|
-
return getCognitoClient().send(new ConfirmSignUpCommand({
|
|
572
|
-
ClientId: a.clientId,
|
|
573
|
-
Username: a.username,
|
|
574
|
-
ConfirmationCode: a.confirmationCode,
|
|
575
|
-
SecretHash: computeSecretHash(a.username, a.clientId, a.clientSecret)
|
|
576
|
-
}));
|
|
577
|
-
}, (e) => {
|
|
578
|
-
console.error("ConfirmSignUpCommand error", e);
|
|
579
|
-
return error_cognito(e);
|
|
580
|
-
})();
|
|
721
|
+
return confirmSignupResult(a);
|
|
581
722
|
}
|
|
582
723
|
/**
|
|
583
724
|
* Starts a forgot-password flow by sending a reset code to the user.
|
|
@@ -587,16 +728,7 @@ function confirmSignup(a) {
|
|
|
587
728
|
* @param a.clientSecret - Cognito app client secret.
|
|
588
729
|
*/
|
|
589
730
|
function forgotPassword(a) {
|
|
590
|
-
return
|
|
591
|
-
return getCognitoClient().send(new ForgotPasswordCommand({
|
|
592
|
-
ClientId: a.clientId,
|
|
593
|
-
Username: a.username,
|
|
594
|
-
SecretHash: computeSecretHash(a.username, a.clientId, a.clientSecret)
|
|
595
|
-
}));
|
|
596
|
-
}, (e) => {
|
|
597
|
-
console.error("ForgotPasswordCommand error", e);
|
|
598
|
-
return error_cognito(e);
|
|
599
|
-
})();
|
|
731
|
+
return forgotPasswordResult(a);
|
|
600
732
|
}
|
|
601
733
|
/**
|
|
602
734
|
* Signs a user in with ADMIN_USER_PASSWORD_AUTH.
|
|
@@ -608,32 +740,13 @@ function forgotPassword(a) {
|
|
|
608
740
|
* @param a.userPoolId - Cognito user pool ID.
|
|
609
741
|
*/
|
|
610
742
|
function login(a) {
|
|
611
|
-
return
|
|
612
|
-
return getCognitoClient().send(new AdminInitiateAuthCommand({
|
|
613
|
-
AuthFlow: "ADMIN_USER_PASSWORD_AUTH",
|
|
614
|
-
ClientId: a.clientId,
|
|
615
|
-
UserPoolId: a.userPoolId,
|
|
616
|
-
AuthParameters: {
|
|
617
|
-
USERNAME: a.username,
|
|
618
|
-
PASSWORD: a.password,
|
|
619
|
-
SECRET_HASH: computeSecretHash(a.username, a.clientId, a.clientSecret)
|
|
620
|
-
}
|
|
621
|
-
}));
|
|
622
|
-
}, (e) => {
|
|
623
|
-
console.error("AdminInitiateAuthCommand error", e);
|
|
624
|
-
return error_cognito(e);
|
|
625
|
-
})();
|
|
743
|
+
return loginResult(a);
|
|
626
744
|
}
|
|
627
745
|
/**
|
|
628
746
|
* Sends a GetTokensFromRefreshTokenCommand
|
|
629
747
|
*/
|
|
630
748
|
function refreshTokens(a) {
|
|
631
|
-
return
|
|
632
|
-
return getCognitoClient().send(new GetTokensFromRefreshTokenCommand(a));
|
|
633
|
-
}, (e) => {
|
|
634
|
-
console.error("refreshTokens: GetTokensFromRefreshTokenCommand error", e);
|
|
635
|
-
return error_cognito(e);
|
|
636
|
-
})();
|
|
749
|
+
return refreshTokensResult(a);
|
|
637
750
|
}
|
|
638
751
|
/**
|
|
639
752
|
* Exchanges a refresh token for new tokens.
|
|
@@ -645,20 +758,7 @@ function refreshTokens(a) {
|
|
|
645
758
|
* @param a.userPoolId - Cognito user pool ID.
|
|
646
759
|
*/
|
|
647
760
|
function refreshTokensAuth(a) {
|
|
648
|
-
return
|
|
649
|
-
return getCognitoClient().send(new AdminInitiateAuthCommand({
|
|
650
|
-
AuthFlow: "REFRESH_TOKEN_AUTH",
|
|
651
|
-
ClientId: a.clientId,
|
|
652
|
-
UserPoolId: a.userPoolId,
|
|
653
|
-
AuthParameters: {
|
|
654
|
-
REFRESH_TOKEN: a.refreshToken,
|
|
655
|
-
SECRET_HASH: computeSecretHash(a.username, a.clientId, a.clientSecret)
|
|
656
|
-
}
|
|
657
|
-
}));
|
|
658
|
-
}, (e) => {
|
|
659
|
-
console.error("refreshTokens: AdminInitiateAuthCommand error", e);
|
|
660
|
-
return error_cognito(e);
|
|
661
|
-
})();
|
|
761
|
+
return refreshTokensAuthResult(a);
|
|
662
762
|
}
|
|
663
763
|
/**
|
|
664
764
|
* Globally signs out a user by invalidating all refresh tokens.
|
|
@@ -666,12 +766,7 @@ function refreshTokensAuth(a) {
|
|
|
666
766
|
* @param accessToken - Access token for the authenticated user.
|
|
667
767
|
*/
|
|
668
768
|
function logout(accessToken) {
|
|
669
|
-
return
|
|
670
|
-
return getCognitoClient().send(new GlobalSignOutCommand({ AccessToken: accessToken }));
|
|
671
|
-
}, (e) => {
|
|
672
|
-
console.error("GlobalSignOutCommand error", e);
|
|
673
|
-
return error_cognito(e);
|
|
674
|
-
})();
|
|
769
|
+
return logoutResult(accessToken);
|
|
675
770
|
}
|
|
676
771
|
/**
|
|
677
772
|
* Completes a NEW_PASSWORD_REQUIRED challenge for users who must set a new password.
|
|
@@ -683,21 +778,7 @@ function logout(accessToken) {
|
|
|
683
778
|
* @param a.clientSecret - Cognito app client secret.
|
|
684
779
|
*/
|
|
685
780
|
function resetPassword(a) {
|
|
686
|
-
return
|
|
687
|
-
return getCognitoClient().send(new RespondToAuthChallengeCommand({
|
|
688
|
-
ChallengeName: "NEW_PASSWORD_REQUIRED",
|
|
689
|
-
ClientId: a.clientId,
|
|
690
|
-
Session: a.session,
|
|
691
|
-
ChallengeResponses: {
|
|
692
|
-
SECRET_HASH: computeSecretHash(a.username, a.clientId, a.clientSecret),
|
|
693
|
-
NEW_PASSWORD: a.newPassword,
|
|
694
|
-
USERNAME: a.username
|
|
695
|
-
}
|
|
696
|
-
}));
|
|
697
|
-
}, (e) => {
|
|
698
|
-
console.error("RespondToAuthChallengeCommand error", e);
|
|
699
|
-
return error_cognito(e);
|
|
700
|
-
})();
|
|
781
|
+
return resetPasswordResult(a);
|
|
701
782
|
}
|
|
702
783
|
/**
|
|
703
784
|
* Registers a new user with Cognito and optional custom attributes.
|
|
@@ -709,28 +790,7 @@ function resetPassword(a) {
|
|
|
709
790
|
* @param a.<attribute> - Any additional user attributes to set.
|
|
710
791
|
*/
|
|
711
792
|
function signUp(a) {
|
|
712
|
-
return
|
|
713
|
-
const cognitoClient = getCognitoClient();
|
|
714
|
-
const secretHash = computeSecretHash(a.username, a.clientId, a.clientSecret);
|
|
715
|
-
return cognitoClient.send(new SignUpCommand({
|
|
716
|
-
ClientId: a.clientId,
|
|
717
|
-
Username: a.username,
|
|
718
|
-
Password: a.password,
|
|
719
|
-
SecretHash: secretHash,
|
|
720
|
-
UserAttributes: Object.entries(a).filter(([key]) => ![
|
|
721
|
-
"username",
|
|
722
|
-
"password",
|
|
723
|
-
"clientId",
|
|
724
|
-
"clientSecret"
|
|
725
|
-
].includes(key)).map(([key, value]) => ({
|
|
726
|
-
Name: key,
|
|
727
|
-
Value: value
|
|
728
|
-
}))
|
|
729
|
-
}));
|
|
730
|
-
}, (e) => {
|
|
731
|
-
console.error("SignUpCommand error", e);
|
|
732
|
-
return error_cognito(e);
|
|
733
|
-
})();
|
|
793
|
+
return signUpResult(a);
|
|
734
794
|
}
|
|
735
795
|
/**
|
|
736
796
|
* Exchanges an OAuth2 authorization code for Cognito tokens using the token endpoint.
|
|
@@ -744,30 +804,7 @@ function signUp(a) {
|
|
|
744
804
|
* @returns Parsed token payload containing `access_token`, `id_token`, `refresh_token`, token type, and expiry.
|
|
745
805
|
*/
|
|
746
806
|
function verifyOAuthToken(a) {
|
|
747
|
-
return
|
|
748
|
-
const basicAuth = Buffer.from(`${a.clientId}:${a.clientSecret}`).toString("base64");
|
|
749
|
-
const params = new URLSearchParams();
|
|
750
|
-
params.append("grant_type", "authorization_code");
|
|
751
|
-
params.append("code", a.code);
|
|
752
|
-
params.append("redirect_uri", a.redirectUri);
|
|
753
|
-
console.log("verifyOAuthToken: params", params.toString());
|
|
754
|
-
const tokenRes = await fetch(`https://${a.cognitoDomain}/oauth2/token`, {
|
|
755
|
-
method: "POST",
|
|
756
|
-
headers: {
|
|
757
|
-
"Content-Type": "application/x-www-form-urlencoded",
|
|
758
|
-
Authorization: `Basic ${basicAuth}`
|
|
759
|
-
},
|
|
760
|
-
body: params.toString()
|
|
761
|
-
});
|
|
762
|
-
if (!tokenRes.ok) {
|
|
763
|
-
console.error("verifyOAuthToken: token exchange failed", await tokenRes.text());
|
|
764
|
-
throw Object.assign(/* @__PURE__ */ new Error("OAuth token exchange failed"), { name: "NotAuthorizedException" });
|
|
765
|
-
}
|
|
766
|
-
return await tokenRes.json();
|
|
767
|
-
}, (e) => {
|
|
768
|
-
console.error("verifyOAuthToken:error", e);
|
|
769
|
-
return error_cognito(e);
|
|
770
|
-
})();
|
|
807
|
+
return verifyOAuthTokenResult(a);
|
|
771
808
|
}
|
|
772
809
|
/**
|
|
773
810
|
* Exchanges an OAuth2 refresh token for Cognito tokens using the oauth token endpoint.
|
|
@@ -780,29 +817,7 @@ function verifyOAuthToken(a) {
|
|
|
780
817
|
* @returns Parsed token payload containing `access_token`, `id_token`, `refresh_token`, token type, and expiry.
|
|
781
818
|
*/
|
|
782
819
|
function refreshOAuthToken(a) {
|
|
783
|
-
return
|
|
784
|
-
const basicAuth = Buffer.from(`${a.clientId}:${a.clientSecret}`).toString("base64");
|
|
785
|
-
const params = new URLSearchParams();
|
|
786
|
-
params.append("grant_type", "refresh_token");
|
|
787
|
-
params.append("refresh_token", a.refreshToken);
|
|
788
|
-
console.log("refreshOAuthToken: params", params.toString());
|
|
789
|
-
const tokenRes = await fetch(`https://${a.cognitoDomain}/oauth2/token`, {
|
|
790
|
-
method: "POST",
|
|
791
|
-
headers: {
|
|
792
|
-
"Content-Type": "application/x-www-form-urlencoded",
|
|
793
|
-
Authorization: `Basic ${basicAuth}`
|
|
794
|
-
},
|
|
795
|
-
body: params.toString()
|
|
796
|
-
});
|
|
797
|
-
if (!tokenRes.ok) {
|
|
798
|
-
console.error("refreshOAuthToken: token exchange failed", await tokenRes.text());
|
|
799
|
-
throw Object.assign(/* @__PURE__ */ new Error("OAuth token refresh failed"), { name: "NotAuthorizedException" });
|
|
800
|
-
}
|
|
801
|
-
return await tokenRes.json();
|
|
802
|
-
}, (e) => {
|
|
803
|
-
console.error("refreshOAuthToken:error", e);
|
|
804
|
-
return error_cognito(e);
|
|
805
|
-
})();
|
|
820
|
+
return refreshOAuthTokenResult(a);
|
|
806
821
|
}
|
|
807
822
|
//#endregion
|
|
808
823
|
//#region src/s3/client.ts
|
|
@@ -993,14 +1008,45 @@ function getHttpStatusCode$1(error) {
|
|
|
993
1008
|
}
|
|
994
1009
|
//#endregion
|
|
995
1010
|
//#region src/s3/signedUrl.ts
|
|
996
|
-
|
|
997
|
-
|
|
998
|
-
|
|
999
|
-
|
|
1000
|
-
})(...args);
|
|
1001
|
-
}
|
|
1011
|
+
const getSignedUrl = /* @__PURE__ */ ResultAsync.fromThrowable(getSignedUrl$1, (e) => {
|
|
1012
|
+
console.error("getSignedUrl: Failed to get signed url", e);
|
|
1013
|
+
return error_s3(e);
|
|
1014
|
+
});
|
|
1002
1015
|
//#endregion
|
|
1003
1016
|
//#region src/s3/object.ts
|
|
1017
|
+
const getObjectResult = /* @__PURE__ */ ResultAsync.fromThrowable(async (bucketName, key) => {
|
|
1018
|
+
const s3 = getS3();
|
|
1019
|
+
const cmd = new GetObjectCommand({
|
|
1020
|
+
Bucket: bucketName,
|
|
1021
|
+
Key: key
|
|
1022
|
+
});
|
|
1023
|
+
const stream = (await s3.send(cmd)).Body;
|
|
1024
|
+
return new Promise((resolve, reject) => {
|
|
1025
|
+
const chunks = [];
|
|
1026
|
+
stream.on("data", (chunk) => chunks.push(chunk));
|
|
1027
|
+
stream.on("end", () => resolve(Buffer.concat(chunks)));
|
|
1028
|
+
stream.on("error", reject);
|
|
1029
|
+
});
|
|
1030
|
+
}, (e) => {
|
|
1031
|
+
console.error(`getObjectt: Error getting object from S3: ${e}`);
|
|
1032
|
+
return error_s3(e);
|
|
1033
|
+
});
|
|
1034
|
+
const objectExistsResult = /* @__PURE__ */ ResultAsync.fromThrowable(async (bucketName, key) => {
|
|
1035
|
+
const s3 = getS3();
|
|
1036
|
+
try {
|
|
1037
|
+
const cmd = new HeadObjectCommand({
|
|
1038
|
+
Bucket: bucketName,
|
|
1039
|
+
Key: key
|
|
1040
|
+
});
|
|
1041
|
+
return (await s3.send(cmd)).$metadata.httpStatusCode === 200;
|
|
1042
|
+
} catch (e) {
|
|
1043
|
+
if (is_s3_notFound(e)) return false;
|
|
1044
|
+
throw e;
|
|
1045
|
+
}
|
|
1046
|
+
}, (e) => {
|
|
1047
|
+
console.error(`objectExists: Error getting object head from S3: ${e}`);
|
|
1048
|
+
return error_s3(e);
|
|
1049
|
+
});
|
|
1004
1050
|
/**
|
|
1005
1051
|
* Retrieves an object from an S3 bucket.
|
|
1006
1052
|
*
|
|
@@ -1009,23 +1055,7 @@ function getSignedUrl(...args) {
|
|
|
1009
1055
|
* @returns {Promise<Buffer>} A promise that resolves to the object data as a Buffer.
|
|
1010
1056
|
*/
|
|
1011
1057
|
function getObject(bucketName, key) {
|
|
1012
|
-
return
|
|
1013
|
-
const s3 = getS3();
|
|
1014
|
-
const cmd = new GetObjectCommand({
|
|
1015
|
-
Bucket: bucketName,
|
|
1016
|
-
Key: key
|
|
1017
|
-
});
|
|
1018
|
-
const stream = (await s3.send(cmd)).Body;
|
|
1019
|
-
return new Promise((resolve, reject) => {
|
|
1020
|
-
const chunks = [];
|
|
1021
|
-
stream.on("data", (chunk) => chunks.push(chunk));
|
|
1022
|
-
stream.on("end", () => resolve(Buffer.concat(chunks)));
|
|
1023
|
-
stream.on("error", reject);
|
|
1024
|
-
});
|
|
1025
|
-
}, (e) => {
|
|
1026
|
-
console.error(`getObjectt: Error getting object from S3: ${e}`);
|
|
1027
|
-
return error_s3(e);
|
|
1028
|
-
})();
|
|
1058
|
+
return getObjectResult(bucketName, key);
|
|
1029
1059
|
}
|
|
1030
1060
|
/**
|
|
1031
1061
|
* Convenience function to get an object from S3 and return it as a string.
|
|
@@ -1041,22 +1071,7 @@ function getObjectString(bucketName, key) {
|
|
|
1041
1071
|
* @returns {Promise<Buffer>} A promise that resolves to a boolean.
|
|
1042
1072
|
*/
|
|
1043
1073
|
function objectExists(bucketName, key) {
|
|
1044
|
-
return
|
|
1045
|
-
const s3 = getS3();
|
|
1046
|
-
try {
|
|
1047
|
-
const cmd = new HeadObjectCommand({
|
|
1048
|
-
Bucket: bucketName,
|
|
1049
|
-
Key: key
|
|
1050
|
-
});
|
|
1051
|
-
return (await s3.send(cmd)).$metadata.httpStatusCode === 200;
|
|
1052
|
-
} catch (e) {
|
|
1053
|
-
if (is_s3_notFound(e)) return false;
|
|
1054
|
-
throw e;
|
|
1055
|
-
}
|
|
1056
|
-
}, (e) => {
|
|
1057
|
-
console.error(`objectExists: Error getting object head from S3: ${e}`);
|
|
1058
|
-
return error_s3(e);
|
|
1059
|
-
})();
|
|
1074
|
+
return objectExistsResult(bucketName, key);
|
|
1060
1075
|
}
|
|
1061
1076
|
//#endregion
|
|
1062
1077
|
//#region src/dynamo/errors.ts
|