release(required): Amplify JS release (#14473)

Author: soberm

.github/actions/node-and-build/action.yml

@@ -7,10 +7,10 @@ inputs:
 runs:
   using: 'composite'
   steps:
-    - name: Setup Node.js 20
-      uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
+    - name: Setup Node.js 22
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
-        node-version: 20
+        node-version: 22
       env:
         SEGMENT_DOWNLOAD_TIMEOUT_MINS: 2
     - uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0

.github/dependency-review/dependency-review-config.yml

@@ -1,7 +1,6 @@
 allow-licenses:
   - '0BSD'
   - 'Apache-2.0'
-  - 'Apache-2.0 AND MIT'
   - 'BlueOak-1.0.0'
   - 'BSD-1-Clause'
   - 'BSD-2-Clause-FreeBSD'
@@ -14,7 +13,6 @@ allow-licenses:
   - 'CC0-1.0'
   - 'curl'
   - 'ISC'
-  - 'ISC AND MIT'
   - 'JSON'
   - 'MIT'
   - 'OpenSSL'

.github/workflows/callable-dependency-review.yml

@@ -16,6 +16,6 @@ jobs:
       - name: 'Checkout Repository'
         uses: actions/checkout@e2a5a1afd5d7305b13671410c52a31819ab9fad9 # v4.0.0 https://github.com/actions/checkout/commit/e2a5a1afd5d7305b13671410c52a31819ab9fad9
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@7bbfa034e752445ea40215fff1c3bf9597993d3f # v3.1.3 https://github.com/actions/dependency-review-action/commit/7bbfa034e752445ea40215fff1c3bf9597993d3f
+        uses: actions/dependency-review-action@da24556b548a50705dd671f47852072ea4c105d9 # v4.7.1 https://github.com/actions/dependency-review-action/commit/[hash]
         with:
           config-file: '.github/dependency-review/dependency-review-config.yml'

package.json

@@ -140,11 +140,15 @@
 		"nx": "16.7.0",
 		"xml2js": "0.5.0",
 		"tar": "6.2.1",
-		"**/cross-spawn": "7.0.5"
+		"**/cross-spawn": "7.0.5",
+		"**/brace-expansion": "1.1.12",
+		"**/on-headers": "1.1.0",
+		"**/form-data": "4.0.4"
 	},
 	"overrides": {
 		"tar": "6.2.1",
-		"cross-spawn": "7.0.5"
+		"cross-spawn": "7.0.5",
+		"brace-expansion": "1.1.12"
 	},
 	"packageManager": "[email protected]+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e"
 }

packages/adapter-nextjs/__tests__/auth/utils/predicates.test.ts

@@ -39,4 +39,124 @@ describe('isNextRequest', () => {
 
 		expect(isNextRequest(request)).toBe(true);
 	});
+
+	it('returns true when the request is like a next request', () => {
+		const mockNextRequest = {
+			nextUrl: {
+				pathname: '/api/auth',
+				search: '?param=value',
+				searchParams: new URLSearchParams('param=value'),
+				href: 'https://example.com/api/auth?param=value',
+			},
+			cookies: {
+				get: jest.fn(),
+				set: jest.fn(),
+				delete: jest.fn(),
+			},
+			url: 'https://example.com/api/auth?param=value',
+			headers: new Headers({
+				'content-type': 'application/json',
+				'user-agent': 'test-agent',
+			}),
+			method: 'POST',
+			body: null,
+			bodyUsed: false,
+		};
+
+		expect(isNextRequest(mockNextRequest)).toBe(true);
+	});
+
+	it('returns false for regular Request objects without NextRequest properties', () => {
+		const regularRequest = {
+			headers: new Headers(),
+			method: 'GET',
+			url: 'https://example.com',
+		};
+
+		expect(isNextRequest(regularRequest)).toBe(false);
+	});
+
+	it('returns false for objects with nextUrl but missing other required properties', () => {
+		const incompleteObject = {
+			nextUrl: {
+				pathname: '/test',
+				search: '',
+			},
+		};
+
+		expect(isNextRequest(incompleteObject)).toBe(false);
+	});
+
+	it('returns false for objects with malformed nextUrl', () => {
+		const malformedNextUrl = {
+			nextUrl: 'not-an-object',
+			cookies: {},
+			headers: new Headers(),
+			method: 'GET',
+			url: 'https://example.com',
+		};
+
+		expect(isNextRequest(malformedNextUrl)).toBe(false);
+	});
+
+	it('returns false for objects with null nextUrl', () => {
+		const nullNextUrl = {
+			nextUrl: null,
+			cookies: {},
+			headers: new Headers(),
+			method: 'GET',
+			url: 'https://example.com',
+		};
+
+		expect(isNextRequest(nullNextUrl)).toBe(false);
+	});
+
+	it('returns false for objects missing cookies property', () => {
+		const missingCookies = {
+			nextUrl: {
+				pathname: '/test',
+				search: '',
+			},
+			headers: new Headers(),
+			method: 'GET',
+			url: 'https://example.com',
+		};
+
+		expect(isNextRequest(missingCookies)).toBe(false);
+	});
+
+	it('returns false for objects with non-string method', () => {
+		const invalidMethod = {
+			nextUrl: {
+				pathname: '/test',
+				search: '',
+			},
+			cookies: {},
+			headers: new Headers(),
+			method: 123,
+			url: 'https://example.com',
+		};
+
+		expect(isNextRequest(invalidMethod)).toBe(false);
+	});
+
+	it('returns false for objects with non-string url', () => {
+		const invalidUrl = {
+			nextUrl: {
+				pathname: '/test',
+				search: '',
+			},
+			cookies: {},
+			headers: new Headers(),
+			method: 'GET',
+			url: 123,
+		};
+
+		expect(isNextRequest(invalidUrl)).toBe(false);
+	});
+
+	it('returns false for null or undefined inputs', () => {
+		expect(isNextRequest(null as any)).toBe(false);
+		expect(isNextRequest(undefined as any)).toBe(false);
+	});
 });

packages/adapter-nextjs/src/auth/utils/predicates.ts

@@ -10,7 +10,25 @@ import { AuthRoutesHandlerContext } from '../types';
 export function isNextRequest(request: object): request is NextRequest {
 	// NextRequest extends the Web Request API with additional convenience methods.
 	// Details: https://nextjs.org/docs/app/api-reference/functions/next-request#nexturl
-	return request instanceof Request && 'nextUrl' in request;
+	//
+	// Use duck typing instead of instanceof to handle Lambda/serverless environments
+	// where Request constructor references may differ between invocations
+
+	return (
+		typeof request === 'object' &&
+		request !== null &&
+		// NextRequest-specific properties
+		'nextUrl' in request &&
+		typeof request.nextUrl === 'object' &&
+		request.nextUrl !== null &&
+		'cookies' in request &&
+		// Basic Request API properties
+		'url' in request &&
+		typeof request.url === 'string' &&
+		'headers' in request &&
+		'method' in request &&
+		typeof request.method === 'string'
+	);
 }
 
 // AuthRoutesHandlersContext is the 2nd parameter type for the API route handlers in the App Router

packages/api-rest/__tests__/apis/common/publicApis.test.ts

@@ -192,6 +192,36 @@ describe('public APIs', () => {
 				);
 			});
 
+			if (!['HEAD'].includes(method.toUpperCase())) {
+				it('should support body', async () => {
+					await fn(mockAmplifyInstance, {
+						apiName: 'restApi1',
+						path: '/items',
+						options: {
+							body: {
+								message: 'body',
+							},
+						},
+					}).response;
+					expect(mockAuthenticatedHandler).toHaveBeenCalledWith(
+						{
+							url: new URL(
+								'https://123.execute-api.us-west-2.amazonaws.com/development/items',
+							),
+							method,
+							headers: {
+								'content-type': 'application/json; charset=UTF-8',
+							},
+							body: '{"message":"body"}',
+						},
+						expect.objectContaining({
+							region: 'us-west-2',
+							service: 'execute-api',
+						}),
+					);
+				});
+			}
+
 			it('should support path parameters', async () => {
 				await fn(mockAmplifyInstance, {
 					apiName: 'restApi1',

packages/api-rest/src/types/index.ts

@@ -6,14 +6,14 @@ export type GetInput = ApiInput<RestApiOptionsBase>;
 export type PostInput = ApiInput<RestApiOptionsBase>;
 export type PutInput = ApiInput<RestApiOptionsBase>;
 export type PatchInput = ApiInput<RestApiOptionsBase>;
-export type DeleteInput = ApiInput<Omit<RestApiOptionsBase, 'body'>>;
+export type DeleteInput = ApiInput<RestApiOptionsBase>;
 export type HeadInput = ApiInput<Omit<RestApiOptionsBase, 'body'>>;
 
 export type GetOperation = Operation<RestApiResponse>;
 export type PostOperation = Operation<RestApiResponse>;
 export type PutOperation = Operation<RestApiResponse>;
 export type PatchOperation = Operation<RestApiResponse>;
-export type DeleteOperation = Operation<Omit<RestApiResponse, 'body'>>;
+export type DeleteOperation = Operation<RestApiResponse>;
 export type HeadOperation = Operation<Omit<RestApiResponse, 'body'>>;
 
 /**