Skip to content

Commit d8884d3

Browse files
author
awstools
committed
feat(client-cognito-identity-provider): This release adds refresh token rotation.
1 parent 216c012 commit d8884d3

19 files changed

+931
-220
lines changed

clients/client-cognito-identity-provider/README.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -776,6 +776,14 @@ GetSigningCertificate
776776

777777
[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/cognito-identity-provider/command/GetSigningCertificateCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-cognito-identity-provider/Interface/GetSigningCertificateCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-cognito-identity-provider/Interface/GetSigningCertificateCommandOutput/)
778778

779+
</details>
780+
<details>
781+
<summary>
782+
GetTokensFromRefreshToken
783+
</summary>
784+
785+
[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/cognito-identity-provider/command/GetTokensFromRefreshTokenCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-cognito-identity-provider/Interface/GetTokensFromRefreshTokenCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-cognito-identity-provider/Interface/GetTokensFromRefreshTokenCommandOutput/)
786+
779787
</details>
780788
<details>
781789
<summary>

clients/client-cognito-identity-provider/src/CognitoIdentityProvider.ts

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -323,6 +323,11 @@ import {
323323
GetSigningCertificateCommandInput,
324324
GetSigningCertificateCommandOutput,
325325
} from "./commands/GetSigningCertificateCommand";
326+
import {
327+
GetTokensFromRefreshTokenCommand,
328+
GetTokensFromRefreshTokenCommandInput,
329+
GetTokensFromRefreshTokenCommandOutput,
330+
} from "./commands/GetTokensFromRefreshTokenCommand";
326331
import {
327332
GetUICustomizationCommand,
328333
GetUICustomizationCommandInput,
@@ -586,6 +591,7 @@ const commands = {
586591
GetIdentityProviderByIdentifierCommand,
587592
GetLogDeliveryConfigurationCommand,
588593
GetSigningCertificateCommand,
594+
GetTokensFromRefreshTokenCommand,
589595
GetUICustomizationCommand,
590596
GetUserCommand,
591597
GetUserAttributeVerificationCodeCommand,
@@ -1707,6 +1713,23 @@ export interface CognitoIdentityProvider {
17071713
cb: (err: any, data?: GetSigningCertificateCommandOutput) => void
17081714
): void;
17091715

1716+
/**
1717+
* @see {@link GetTokensFromRefreshTokenCommand}
1718+
*/
1719+
getTokensFromRefreshToken(
1720+
args: GetTokensFromRefreshTokenCommandInput,
1721+
options?: __HttpHandlerOptions
1722+
): Promise<GetTokensFromRefreshTokenCommandOutput>;
1723+
getTokensFromRefreshToken(
1724+
args: GetTokensFromRefreshTokenCommandInput,
1725+
cb: (err: any, data?: GetTokensFromRefreshTokenCommandOutput) => void
1726+
): void;
1727+
getTokensFromRefreshToken(
1728+
args: GetTokensFromRefreshTokenCommandInput,
1729+
options: __HttpHandlerOptions,
1730+
cb: (err: any, data?: GetTokensFromRefreshTokenCommandOutput) => void
1731+
): void;
1732+
17101733
/**
17111734
* @see {@link GetUICustomizationCommand}
17121735
*/

clients/client-cognito-identity-provider/src/CognitoIdentityProviderClient.ts

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -253,6 +253,10 @@ import {
253253
GetSigningCertificateCommandInput,
254254
GetSigningCertificateCommandOutput,
255255
} from "./commands/GetSigningCertificateCommand";
256+
import {
257+
GetTokensFromRefreshTokenCommandInput,
258+
GetTokensFromRefreshTokenCommandOutput,
259+
} from "./commands/GetTokensFromRefreshTokenCommand";
256260
import { GetUICustomizationCommandInput, GetUICustomizationCommandOutput } from "./commands/GetUICustomizationCommand";
257261
import {
258262
GetUserAttributeVerificationCodeCommandInput,
@@ -450,6 +454,7 @@ export type ServiceInputTypes =
450454
| GetIdentityProviderByIdentifierCommandInput
451455
| GetLogDeliveryConfigurationCommandInput
452456
| GetSigningCertificateCommandInput
457+
| GetTokensFromRefreshTokenCommandInput
453458
| GetUICustomizationCommandInput
454459
| GetUserAttributeVerificationCodeCommandInput
455460
| GetUserAuthFactorsCommandInput
@@ -568,6 +573,7 @@ export type ServiceOutputTypes =
568573
| GetIdentityProviderByIdentifierCommandOutput
569574
| GetLogDeliveryConfigurationCommandOutput
570575
| GetSigningCertificateCommandOutput
576+
| GetTokensFromRefreshTokenCommandOutput
571577
| GetUICustomizationCommandOutput
572578
| GetUserAttributeVerificationCodeCommandOutput
573579
| GetUserAuthFactorsCommandOutput

clients/client-cognito-identity-provider/src/commands/AdminInitiateAuthCommand.ts

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -193,6 +193,10 @@ export interface AdminInitiateAuthCommandOutput extends AdminInitiateAuthRespons
193193
* <p>This exception is thrown when Amazon Cognito encounters an unexpected exception with
194194
* Lambda.</p>
195195
*
196+
* @throws {@link UnsupportedOperationException} (client fault)
197+
* <p>Exception that is thrown when you attempt to perform an operation that isn't enabled
198+
* for the user pool client.</p>
199+
*
196200
* @throws {@link UserLambdaValidationException} (client fault)
197201
* <p>This exception is thrown when the Amazon Cognito service encounters a user validation exception
198202
* with the Lambda service.</p>

clients/client-cognito-identity-provider/src/commands/CreateUserPoolClientCommand.ts

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,10 @@ export interface CreateUserPoolClientCommandOutput extends CreateUserPoolClientR
119119
* EnableTokenRevocation: true || false,
120120
* EnablePropagateAdditionalUserContextData: true || false,
121121
* AuthSessionValidity: Number("int"),
122+
* RefreshTokenRotation: { // RefreshTokenRotationType
123+
* Feature: "ENABLED" || "DISABLED", // required
124+
* RetryGracePeriodSeconds: Number("int"),
125+
* },
122126
* };
123127
* const command = new CreateUserPoolClientCommand(input);
124128
* const response = await client.send(command);
@@ -175,6 +179,10 @@ export interface CreateUserPoolClientCommandOutput extends CreateUserPoolClientR
175179
* // EnableTokenRevocation: true || false,
176180
* // EnablePropagateAdditionalUserContextData: true || false,
177181
* // AuthSessionValidity: Number("int"),
182+
* // RefreshTokenRotation: { // RefreshTokenRotationType
183+
* // Feature: "ENABLED" || "DISABLED", // required
184+
* // RetryGracePeriodSeconds: Number("int"),
185+
* // },
178186
* // },
179187
* // };
180188
*
@@ -186,6 +194,10 @@ export interface CreateUserPoolClientCommandOutput extends CreateUserPoolClientR
186194
* @see {@link CreateUserPoolClientCommandOutput} for command's `response` shape.
187195
* @see {@link CognitoIdentityProviderClientResolvedConfig | config} for CognitoIdentityProviderClient's `config` shape.
188196
*
197+
* @throws {@link FeatureUnavailableInTierException} (client fault)
198+
* <p>This exception is thrown when a feature you attempted to configure isn't
199+
* available in your current feature plan.</p>
200+
*
189201
* @throws {@link InternalErrorException} (server fault)
190202
* <p>This exception is thrown when Amazon Cognito encounters an internal error.</p>
191203
*

clients/client-cognito-identity-provider/src/commands/CreateUserPoolDomainCommand.ts

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,10 @@ export interface CreateUserPoolDomainCommandOutput extends CreateUserPoolDomainR
9191
* @see {@link CreateUserPoolDomainCommandOutput} for command's `response` shape.
9292
* @see {@link CognitoIdentityProviderClientResolvedConfig | config} for CognitoIdentityProviderClient's `config` shape.
9393
*
94+
* @throws {@link ConcurrentModificationException} (client fault)
95+
* <p>This exception is thrown if two or more modifications are happening
96+
* concurrently.</p>
97+
*
9498
* @throws {@link FeatureUnavailableInTierException} (client fault)
9599
* <p>This exception is thrown when a feature you attempted to configure isn't
96100
* available in your current feature plan.</p>

clients/client-cognito-identity-provider/src/commands/DeleteUserPoolDomainCommand.ts

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,10 @@ export interface DeleteUserPoolDomainCommandOutput extends DeleteUserPoolDomainR
5757
* @see {@link DeleteUserPoolDomainCommandOutput} for command's `response` shape.
5858
* @see {@link CognitoIdentityProviderClientResolvedConfig | config} for CognitoIdentityProviderClient's `config` shape.
5959
*
60+
* @throws {@link ConcurrentModificationException} (client fault)
61+
* <p>This exception is thrown if two or more modifications are happening
62+
* concurrently.</p>
63+
*
6064
* @throws {@link InternalErrorException} (server fault)
6165
* <p>This exception is thrown when Amazon Cognito encounters an internal error.</p>
6266
*

clients/client-cognito-identity-provider/src/commands/DescribeUserPoolClientCommand.ts

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,10 @@ export interface DescribeUserPoolClientCommandOutput extends DescribeUserPoolCli
125125
* // EnableTokenRevocation: true || false,
126126
* // EnablePropagateAdditionalUserContextData: true || false,
127127
* // AuthSessionValidity: Number("int"),
128+
* // RefreshTokenRotation: { // RefreshTokenRotationType
129+
* // Feature: "ENABLED" || "DISABLED", // required
130+
* // RetryGracePeriodSeconds: Number("int"),
131+
* // },
128132
* // },
129133
* // };
130134
*
Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
// smithy-typescript generated code
2+
import { getEndpointPlugin } from "@smithy/middleware-endpoint";
3+
import { getSerdePlugin } from "@smithy/middleware-serde";
4+
import { Command as $Command } from "@smithy/smithy-client";
5+
import { MetadataBearer as __MetadataBearer } from "@smithy/types";
6+
7+
import {
8+
CognitoIdentityProviderClientResolvedConfig,
9+
ServiceInputTypes,
10+
ServiceOutputTypes,
11+
} from "../CognitoIdentityProviderClient";
12+
import { commonParams } from "../endpoint/EndpointParameters";
13+
import {
14+
GetTokensFromRefreshTokenRequest,
15+
GetTokensFromRefreshTokenRequestFilterSensitiveLog,
16+
GetTokensFromRefreshTokenResponse,
17+
GetTokensFromRefreshTokenResponseFilterSensitiveLog,
18+
} from "../models/models_0";
19+
import { de_GetTokensFromRefreshTokenCommand, se_GetTokensFromRefreshTokenCommand } from "../protocols/Aws_json1_1";
20+
21+
/**
22+
* @public
23+
*/
24+
export type { __MetadataBearer };
25+
export { $Command };
26+
/**
27+
* @public
28+
*
29+
* The input for {@link GetTokensFromRefreshTokenCommand}.
30+
*/
31+
export interface GetTokensFromRefreshTokenCommandInput extends GetTokensFromRefreshTokenRequest {}
32+
/**
33+
* @public
34+
*
35+
* The output of {@link GetTokensFromRefreshTokenCommand}.
36+
*/
37+
export interface GetTokensFromRefreshTokenCommandOutput extends GetTokensFromRefreshTokenResponse, __MetadataBearer {}
38+
39+
/**
40+
* <p>Given a refresh token, issues new ID, access, and optionally refresh tokens for the
41+
* user who owns the submitted token. This operation issues a new refresh token and
42+
* invalidates the original refresh token after an optional grace period when refresh token
43+
* rotation is enabled. If refresh token rotation is disabled, issues new ID and access
44+
* tokens only.</p>
45+
* @example
46+
* Use a bare-bones client and the command you need to make an API call.
47+
* ```javascript
48+
* import { CognitoIdentityProviderClient, GetTokensFromRefreshTokenCommand } from "@aws-sdk/client-cognito-identity-provider"; // ES Modules import
49+
* // const { CognitoIdentityProviderClient, GetTokensFromRefreshTokenCommand } = require("@aws-sdk/client-cognito-identity-provider"); // CommonJS import
50+
* const client = new CognitoIdentityProviderClient(config);
51+
* const input = { // GetTokensFromRefreshTokenRequest
52+
* RefreshToken: "STRING_VALUE", // required
53+
* ClientId: "STRING_VALUE", // required
54+
* ClientSecret: "STRING_VALUE",
55+
* DeviceKey: "STRING_VALUE",
56+
* ClientMetadata: { // ClientMetadataType
57+
* "<keys>": "STRING_VALUE",
58+
* },
59+
* };
60+
* const command = new GetTokensFromRefreshTokenCommand(input);
61+
* const response = await client.send(command);
62+
* // { // GetTokensFromRefreshTokenResponse
63+
* // AuthenticationResult: { // AuthenticationResultType
64+
* // AccessToken: "STRING_VALUE",
65+
* // ExpiresIn: Number("int"),
66+
* // TokenType: "STRING_VALUE",
67+
* // RefreshToken: "STRING_VALUE",
68+
* // IdToken: "STRING_VALUE",
69+
* // NewDeviceMetadata: { // NewDeviceMetadataType
70+
* // DeviceKey: "STRING_VALUE",
71+
* // DeviceGroupKey: "STRING_VALUE",
72+
* // },
73+
* // },
74+
* // };
75+
*
76+
* ```
77+
*
78+
* @param GetTokensFromRefreshTokenCommandInput - {@link GetTokensFromRefreshTokenCommandInput}
79+
* @returns {@link GetTokensFromRefreshTokenCommandOutput}
80+
* @see {@link GetTokensFromRefreshTokenCommandInput} for command's `input` shape.
81+
* @see {@link GetTokensFromRefreshTokenCommandOutput} for command's `response` shape.
82+
* @see {@link CognitoIdentityProviderClientResolvedConfig | config} for CognitoIdentityProviderClient's `config` shape.
83+
*
84+
* @throws {@link ForbiddenException} (client fault)
85+
* <p>This exception is thrown when WAF doesn't allow your request based on a web
86+
* ACL that's associated with your user pool.</p>
87+
*
88+
* @throws {@link InternalErrorException} (server fault)
89+
* <p>This exception is thrown when Amazon Cognito encounters an internal error.</p>
90+
*
91+
* @throws {@link InvalidLambdaResponseException} (client fault)
92+
* <p>This exception is thrown when Amazon Cognito encounters an invalid Lambda response.</p>
93+
*
94+
* @throws {@link InvalidParameterException} (client fault)
95+
* <p>This exception is thrown when the Amazon Cognito service encounters an invalid
96+
* parameter.</p>
97+
*
98+
* @throws {@link NotAuthorizedException} (client fault)
99+
* <p>This exception is thrown when a user isn't authorized.</p>
100+
*
101+
* @throws {@link RefreshTokenReuseException} (client fault)
102+
* <p>This exception is throw when your application requests token refresh with a refresh
103+
* token that has been invalidated by refresh-token rotation.</p>
104+
*
105+
* @throws {@link ResourceNotFoundException} (client fault)
106+
* <p>This exception is thrown when the Amazon Cognito service can't find the requested
107+
* resource.</p>
108+
*
109+
* @throws {@link TooManyRequestsException} (client fault)
110+
* <p>This exception is thrown when the user has made too many requests for a given
111+
* operation.</p>
112+
*
113+
* @throws {@link UnexpectedLambdaException} (client fault)
114+
* <p>This exception is thrown when Amazon Cognito encounters an unexpected exception with
115+
* Lambda.</p>
116+
*
117+
* @throws {@link UserLambdaValidationException} (client fault)
118+
* <p>This exception is thrown when the Amazon Cognito service encounters a user validation exception
119+
* with the Lambda service.</p>
120+
*
121+
* @throws {@link UserNotFoundException} (client fault)
122+
* <p>This exception is thrown when a user isn't found.</p>
123+
*
124+
* @throws {@link CognitoIdentityProviderServiceException}
125+
* <p>Base exception class for all service exceptions from CognitoIdentityProvider service.</p>
126+
*
127+
*
128+
* @public
129+
*/
130+
export class GetTokensFromRefreshTokenCommand extends $Command
131+
.classBuilder<
132+
GetTokensFromRefreshTokenCommandInput,
133+
GetTokensFromRefreshTokenCommandOutput,
134+
CognitoIdentityProviderClientResolvedConfig,
135+
ServiceInputTypes,
136+
ServiceOutputTypes
137+
>()
138+
.ep(commonParams)
139+
.m(function (this: any, Command: any, cs: any, config: CognitoIdentityProviderClientResolvedConfig, o: any) {
140+
return [
141+
getSerdePlugin(config, this.serialize, this.deserialize),
142+
getEndpointPlugin(config, Command.getEndpointParameterInstructions()),
143+
];
144+
})
145+
.s("AWSCognitoIdentityProviderService", "GetTokensFromRefreshToken", {})
146+
.n("CognitoIdentityProviderClient", "GetTokensFromRefreshTokenCommand")
147+
.f(GetTokensFromRefreshTokenRequestFilterSensitiveLog, GetTokensFromRefreshTokenResponseFilterSensitiveLog)
148+
.ser(se_GetTokensFromRefreshTokenCommand)
149+
.de(de_GetTokensFromRefreshTokenCommand)
150+
.build() {
151+
/** @internal type navigation helper, not in runtime. */
152+
protected declare static __types: {
153+
api: {
154+
input: GetTokensFromRefreshTokenRequest;
155+
output: GetTokensFromRefreshTokenResponse;
156+
};
157+
sdk: {
158+
input: GetTokensFromRefreshTokenCommandInput;
159+
output: GetTokensFromRefreshTokenCommandOutput;
160+
};
161+
};
162+
}

clients/client-cognito-identity-provider/src/commands/GetUserAuthFactorsCommand.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ import {
1515
GetUserAuthFactorsRequestFilterSensitiveLog,
1616
GetUserAuthFactorsResponse,
1717
GetUserAuthFactorsResponseFilterSensitiveLog,
18-
} from "../models/models_0";
18+
} from "../models/models_1";
1919
import { de_GetUserAuthFactorsCommand, se_GetUserAuthFactorsCommand } from "../protocols/Aws_json1_1";
2020

2121
/**

0 commit comments

Comments
 (0)