wirejs-deploy-amplify-basic 0.0.29 → 0.0.30

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 import { Resource } from 'wirejs-resources';
-export { AuthenticationService, withContext, requiresContext, Context, CookieJar, Resource, overrides, } from 'wirejs-resources';
+export { withContext, requiresContext, Context, CookieJar, Resource, overrides, } from 'wirejs-resources';
+export { AuthenticationService } from './services/authentication.js';
 export declare class FileService extends Resource {
     constructor(scope: Resource | string, id: string);
     read(filename: string, encoding?: BufferEncoding): Promise<string>;

package/dist/index.js

@@ -1,7 +1,10 @@
 import { env } from 'process';
 import { S3Client, ListObjectsCommand, PutObjectCommand, GetObjectCommand, DeleteObjectCommand } from '@aws-sdk/client-s3';
 import { overrides, Resource, } from 'wirejs-resources';
-export { AuthenticationService, withContext, requiresContext, Context, CookieJar, Resource, overrides, } from 'wirejs-resources';
+export { withContext, requiresContext, Context, CookieJar, Resource, overrides, } from 'wirejs-resources';
+import { addResource } from './resource-collector.js';
+import { AuthenticationService } from './services/authentication.js';
+export { AuthenticationService } from './services/authentication.js';
 const Bucket = env['BUCKET'];
 const s3 = new S3Client();
 export class FileService extends Resource {
@@ -61,10 +64,4 @@ export class FileService extends Resource {
 }
 // expose resources to other resources that might depend on it.
 overrides.FileService = FileService;
-globalThis.wirejsResources = [];
-function addResource(type, options) {
-    globalThis.wirejsResources.push({
-        type,
-        options
-    });
-}
+overrides.AuthenticationService = AuthenticationService;

package/dist/resource-collector.d.ts

@@ -0,0 +1 @@
+export declare function addResource(type: string, options: any): void;

package/dist/resource-collector.js

@@ -0,0 +1,7 @@
+globalThis.wirejsResources = [];
+export function addResource(type, options) {
+    globalThis.wirejsResources.push({
+        type,
+        options
+    });
+}

package/dist/services/authentication.d.ts

@@ -0,0 +1,19 @@
+import { Resource, ContextWrapped, CookieJar, AuthenticationError, AuthenticationService as AuthenticationServiceBase, AuthenticationMachineState, AuthenticationServiceOptions, AuthenticationMachineInput, User } from 'wirejs-resources';
+export declare function hasNonEmptyString(o: any, k: string): boolean;
+export declare class AuthenticationService extends AuthenticationServiceBase {
+    #private;
+    constructor(scope: Resource | string, id: string, options?: AuthenticationServiceOptions);
+    getMachineState(cookies: CookieJar): Promise<AuthenticationMachineState>;
+    missingFieldErrors<T extends Record<string, string | number | boolean>>(input: T, fields: (keyof T & string)[]): AuthenticationError[] | undefined;
+    setMachineState(cookies: CookieJar, form: AuthenticationMachineInput): Promise<AuthenticationMachineState | {
+        errors: AuthenticationError[];
+    }>;
+    buildApi(): ContextWrapped<{
+        getState: () => Promise<AuthenticationMachineState>;
+        setState: (options: AuthenticationMachineInput) => Promise<AuthenticationMachineState | {
+            errors: AuthenticationError[];
+        }>;
+        getCurrentUser: () => Promise<User | null>;
+        requireCurrentUser: () => Promise<User>;
+    }>;
+}

package/dist/services/authentication.js

@@ -0,0 +1,491 @@
+import { env } from 'process';
+import * as jose from 'jose';
+import { CognitoIdentityProviderClient, SignUpCommand, ForgotPasswordCommand, ConfirmForgotPasswordCommand, ConfirmSignUpCommand, ResendConfirmationCodeCommand, InitiateAuthCommand, ChangePasswordCommand, } from '@aws-sdk/client-cognito-identity-provider';
+import { withContext, SignedCookie, Secret, AuthenticationService as AuthenticationServiceBase, } from 'wirejs-resources';
+import { addResource } from '../resource-collector.js';
+const ClientId = env['COGNITO_CLIENT_ID'];
+const actions = {
+    changepassword: {
+        name: "Change Password",
+        fields: {
+            existingPassword: {
+                label: 'Old Password',
+                type: 'password',
+            },
+            newPassword: {
+                label: 'New Password',
+                type: 'password',
+            }
+        },
+        buttons: ['Change Password']
+    },
+    signin: {
+        name: "Sign In",
+        fields: {
+            email: {
+                label: 'Email',
+                type: 'text',
+            },
+            password: {
+                label: 'Password',
+                type: 'password',
+            },
+        },
+        buttons: ['Sign In']
+    },
+    startforgotpassword: {
+        name: "Forgot Password"
+    },
+    continueforgotpassword: {
+        name: "Forgot Password",
+        fields: {
+            email: {
+                label: "Email",
+                type: "text"
+            },
+        },
+        buttons: ["Send Reset Code"]
+    },
+    completeforgotpassword: {
+        name: "Reset Password",
+        fields: {
+            code: {
+                label: "Reset Code",
+                type: "text"
+            },
+            password: {
+                label: "New Password",
+                type: 'password'
+            },
+        },
+        buttons: ["Set Password"]
+    },
+    startsignup: {
+        name: "Sign Up",
+        fields: {
+            email: {
+                label: 'Email',
+                type: 'text',
+            },
+            password: {
+                label: 'Password',
+                type: 'password',
+            },
+        },
+        buttons: ['Sign Up']
+    },
+    completesignup: {
+        name: "Finish Signing Up",
+        fields: {
+            code: {
+                label: "Confirmation Code",
+                type: 'text'
+            },
+        },
+        buttons: ['Complete Sign-up']
+    },
+    resendsignupcode: {
+        name: "Resend Confirmation Code"
+    },
+    signout: {
+        name: "Sign out"
+    },
+    cancel: {
+        name: "Cancel"
+    },
+};
+function machineAction(key) {
+    return {
+        key,
+        ...actions[key]
+    };
+}
+function machineActions(...keys) {
+    const result = {};
+    for (const k of keys) {
+        result[k] = machineAction(k);
+    }
+    return result;
+}
+function isAction(input, action) {
+    return input.key === action;
+}
+export function hasNonEmptyString(o, k) {
+    return (typeof o === 'object' && k in o && typeof o[k] === 'string' && o[k].length > 0);
+}
+const ONE_WEEK = 7 * 24 * 60 * 60; // days * hours/day * minutes/hour * seconds/minute
+const client = new CognitoIdentityProviderClient();
+export class AuthenticationService extends AuthenticationServiceBase {
+    #cookie;
+    #keepalive;
+    constructor(scope, id, options = {}) {
+        super(scope, id, options);
+        const signingSecret = new Secret(this, 'jwt-signing-secret');
+        this.#keepalive = options.keepalive ?? false;
+        this.#cookie = new SignedCookie(this, options.cookie ?? 'identity', signingSecret, { maxAge: ONE_WEEK });
+        addResource('AuthenticationService', { absoluteId: this.absoluteId });
+    }
+    async getMachineState(cookies) {
+        const state = await this.#cookie.read(cookies);
+        if (state?.state === 'authenticated') {
+            if (this.#keepalive)
+                this.#cookie.write(cookies, state);
+            return {
+                ...state,
+                actions: machineActions('changepassword', 'signout')
+            };
+        }
+        else {
+            if (state?.substate === 'pending-completesignup') {
+                return {
+                    state: 'unauthenticated',
+                    user: undefined,
+                    actions: machineActions('completesignup', 'cancel')
+                };
+            }
+            else if (state?.substate === 'pending-continueforgotpassword') {
+                return {
+                    state: 'unauthenticated',
+                    user: undefined,
+                    actions: machineActions('continueforgotpassword', 'cancel')
+                };
+            }
+            else if (state?.substate === 'pending-completeforgotpassword') {
+                return {
+                    state: 'unauthenticated',
+                    user: undefined,
+                    actions: machineActions('completeforgotpassword', 'cancel')
+                };
+            }
+            else {
+                return {
+                    state: 'unauthenticated',
+                    user: undefined,
+                    actions: machineActions('signin', 'startsignup')
+                };
+            }
+        }
+    }
+    missingFieldErrors(input, fields) {
+        const errors = [];
+        for (const field of fields) {
+            if (!input[field])
+                errors.push({
+                    field,
+                    message: "Field is required."
+                });
+        }
+        return errors.length > 0 ? errors : undefined;
+    }
+    async setMachineState(cookies, form) {
+        if (isAction(form, 'signout')) {
+            this.#cookie.clear(cookies);
+            return this.getMachineState(cookies);
+        }
+        else if (isAction(form, 'cancel')) {
+            const state = await this.#cookie.read(cookies);
+            if (!state)
+                return this.getMachineState(cookies);
+            state.metadata = undefined;
+            state.substate = undefined;
+            return this.getMachineState(cookies);
+        }
+        else if (isAction(form, 'startsignup')) {
+            const errors = this.missingFieldErrors(form.inputs, ['email', 'password']);
+            if (errors) {
+                return { errors };
+            }
+            try {
+                const command = new SignUpCommand({
+                    ClientId,
+                    Username: form.inputs.email,
+                    Password: form.inputs.password,
+                    UserAttributes: [
+                        { Name: 'email', Value: form.inputs.email }
+                    ]
+                });
+                const result = await client.send(command);
+                this.#cookie.write(cookies, {
+                    state: 'unauthenticated',
+                    user: undefined,
+                    substate: 'pending-completesignup',
+                    metadata: JSON.stringify({
+                        email: form.inputs.email,
+                        sub: result.UserSub,
+                    })
+                });
+                return this.getMachineState(cookies);
+            }
+            catch (error) {
+                return {
+                    errors: [{
+                            message: error.message
+                        }]
+                };
+            }
+        }
+        else if (isAction(form, 'resendsignupcode')) {
+            const state = await this.#cookie.read(cookies);
+            if (!state) {
+                this.#cookie.clear(cookies);
+                return this.getMachineState(cookies);
+            }
+            // bad state ...
+            if (state?.state === 'authenticated'
+                || state?.substate !== 'pending-completesignup'
+                || !state?.metadata) {
+                this.#cookie.write(cookies, {
+                    ...state,
+                    substate: undefined,
+                    metadata: undefined,
+                });
+                return this.getMachineState(cookies);
+            }
+            try {
+                const command = new ResendConfirmationCodeCommand({
+                    ClientId,
+                    Username: state.metadata
+                });
+                await client.send(command);
+                return {
+                    ...this.getMachineState(cookies),
+                    message: 'Your code has been sent again.'
+                };
+            }
+            catch (error) {
+                return {
+                    errors: [{
+                            message: error.message
+                        }]
+                };
+            }
+        }
+        else if (isAction(form, 'completesignup')) {
+            const errors = this.missingFieldErrors(form.inputs, ['code']);
+            if (errors) {
+                return { errors };
+            }
+            const state = await this.#cookie.read(cookies);
+            if (!state || state.substate !== 'pending-completesignup') {
+                this.#cookie.clear(cookies);
+                return this.getMachineState(cookies);
+            }
+            try {
+                const { email, sub } = JSON.parse(state.metadata);
+                if (!email || !sub) {
+                    this.#cookie.clear(cookies);
+                    return this.getMachineState(cookies);
+                }
+                const command = new ConfirmSignUpCommand({
+                    ClientId,
+                    Username: state.metadata,
+                    ConfirmationCode: form.inputs.code
+                });
+                await client.send(command);
+                this.#cookie.write(cookies, {
+                    state: 'authenticated',
+                    user: {
+                        id: sub,
+                        displayName: email,
+                        username: email,
+                    }
+                });
+                return this.getMachineState(cookies);
+            }
+            catch (error) {
+                return {
+                    errors: [{
+                            message: error.message
+                        }]
+                };
+            }
+        }
+        else if (isAction(form, 'signin')) {
+            const errors = this.missingFieldErrors(form.inputs, ['email', 'password']);
+            if (errors) {
+                return { errors };
+            }
+            try {
+                const command = new InitiateAuthCommand({
+                    ClientId,
+                    AuthFlow: 'USER_PASSWORD_AUTH',
+                    AuthParameters: {
+                        USERNAME: form.inputs.email,
+                        PASSWORD: form.inputs.password,
+                    }
+                });
+                const result = await client.send(command);
+                const jwtPayload = jose.decodeJwt(
+                // assuming for now, until we support challenges like OTP, Email code, etc.
+                result.AuthenticationResult?.IdToken);
+                this.#cookie.write(cookies, {
+                    state: 'authenticated',
+                    user: {
+                        id: jwtPayload.sub,
+                        username: jwtPayload['cognito:username'],
+                        displayName: jwtPayload['cognito:username'],
+                    },
+                });
+                return this.getMachineState(cookies);
+            }
+            catch (error) {
+                return {
+                    errors: [{
+                            message: error.message
+                        }]
+                };
+            }
+        }
+        else if (isAction(form, 'changepassword')) {
+            const errors = this.missingFieldErrors(form.inputs, ['existingPassword', 'newPassword']);
+            if (errors) {
+                return { errors };
+            }
+            const state = await this.#cookie.read(cookies);
+            if (state?.state !== 'authenticated') {
+                this.#cookie.clear(cookies);
+                return this.getMachineState(cookies);
+            }
+            try {
+                // change password requires an access token, which we don't actually store.
+                // so, first step is to actually authenticate.
+                const authCommand = new InitiateAuthCommand({
+                    ClientId,
+                    AuthFlow: 'USER_PASSWORD_AUTH',
+                    AuthParameters: {
+                        USERNAME: state.user.username,
+                        PASSWORD: form.inputs.existingPassword,
+                    }
+                });
+                const authResult = await client.send(authCommand);
+                const changePassCommand = new ChangePasswordCommand({
+                    AccessToken: authResult.AuthenticationResult?.AccessToken,
+                    PreviousPassword: form.inputs.existingPassword,
+                    ProposedPassword: form.inputs.newPassword
+                });
+                await client.send(changePassCommand);
+                return {
+                    ...this.getMachineState(cookies),
+                    message: 'Password changed.'
+                };
+            }
+            catch (error) {
+                return {
+                    errors: [{
+                            message: error.message
+                        }]
+                };
+            }
+        }
+        else if (isAction(form, 'startforgotpassword')) {
+            const state = await this.#cookie.read(cookies);
+            if (state?.state === 'authenticated') {
+                // user is already signed in ... this is *probably* a rogue request?
+                return this.getMachineState(cookies);
+            }
+            await this.#cookie.write(cookies, {
+                state: 'unauthenticated',
+                user: undefined,
+                substate: 'pending-continueforgotpassword'
+            });
+            return this.getMachineState(cookies);
+        }
+        else if (isAction(form, 'continueforgotpassword')) {
+            const state = await this.#cookie.read(cookies);
+            if (state?.state === 'authenticated') {
+                // user is already signed in ... this is *probably* a rogue request?
+                return this.getMachineState(cookies);
+            }
+            const errors = this.missingFieldErrors(form.inputs, ['email']);
+            if (errors) {
+                return { errors };
+            }
+            try {
+                const command = new ForgotPasswordCommand({
+                    ClientId,
+                    Username: form.inputs.email
+                });
+                await client.send(command);
+                this.#cookie.write(cookies, {
+                    state: 'unauthenticated',
+                    user: undefined,
+                    substate: 'pending-completeforgotpassword',
+                    metadata: form.inputs.email,
+                });
+                return this.getMachineState(cookies);
+            }
+            catch (error) {
+                return {
+                    errors: [{
+                            message: error.message
+                        }]
+                };
+            }
+        }
+        else if (isAction(form, 'completeforgotpassword')) {
+            const state = await this.#cookie.read(cookies);
+            if (state?.state === 'authenticated') {
+                // user is already signed in ... this is *probably* a rogue request?
+                return this.getMachineState(cookies);
+            }
+            const errors = this.missingFieldErrors(form.inputs, ['code', 'password']);
+            if (errors) {
+                return { errors };
+            }
+            try {
+                const command = new ConfirmForgotPasswordCommand({
+                    ClientId,
+                    ConfirmationCode: form.inputs.code,
+                    Password: form.inputs.password,
+                    Username: state?.metadata
+                });
+                await client.send(command);
+                this.#cookie.write(cookies, {
+                    state: 'unauthenticated',
+                    user: undefined,
+                });
+                return {
+                    ...this.getMachineState(cookies),
+                    message: `Password set. Please try signing in with your new password.`
+                };
+            }
+            catch (error) {
+                return {
+                    errors: [{
+                            message: error.message
+                        }]
+                };
+            }
+        }
+        else {
+            return { errors: [{
+                        message: 'Unrecognized authentication action.'
+                    }]
+            };
+        }
+    }
+    buildApi() {
+        return withContext(context => ({
+            getState: () => this.getMachineState(context.cookies),
+            setState: (options) => this.setMachineState(context.cookies, options),
+            getCurrentUser: async () => {
+                const state = await this.#cookie.read(context.cookies);
+                if (state?.state === 'authenticated') {
+                    return state.user;
+                }
+                else {
+                    return null;
+                }
+            },
+            requireCurrentUser: async () => {
+                const state = await this.#cookie.read(context.cookies);
+                if (state?.state === 'authenticated') {
+                    return state.user;
+                }
+                else {
+                    throw new Error("Unauthorized.");
+                }
+            }
+        }));
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "wirejs-deploy-amplify-basic",
-	"version": "0.0.29",
+	"version": "0.0.30",
 	"type": "module",
 	"main": "./dist/index.js",
 	"types": "./dist/index.d.ts",