fix(Auth): Adding ASF DeviceId as an input for Cognito APIs (#2833)

harsh62 · web-flow · commit b3afc1f5aebe · 2023-03-27T10:19:23.000-04:00
* fix(Auth): Adding ASF DeviceId as an input for Cognito APIs

* Added new unit tests for ConfirmSignUp Input

* Updated ConfirmSignUp tests

* Adding test for respondToAuthInputs
diff --git a/AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Actions/SignIn/DeviceSRPAuth/InitiateAuthDeviceSRP.swift b/AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Actions/SignIn/DeviceSRPAuth/InitiateAuthDeviceSRP.swift
@@ -33,6 +33,10 @@ struct InitiateAuthDeviceSRP: Action {
                 for: username,
                 with: environment)
 
+            let asfDeviceId = try await CognitoUserPoolASF.asfDeviceID(
+                for: username,
+                credentialStoreClient: environment.authEnvironment().credentialsClient)
+
             let srpStateData = SRPStateData(
                 username: username,
                 password: "",
@@ -45,6 +49,7 @@ struct InitiateAuthDeviceSRP: Action {
                 username: username,
                 environment: userPoolEnv,
                 deviceMetadata: deviceMetadata,
+                asfDeviceId: asfDeviceId,
                 session: authResponse.session,
                 publicHexValue: srpKeyPair.publicKeyHexValue)
 
diff --git a/AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Actions/SignIn/DeviceSRPAuth/VerifyDevicePasswordSRP.swift b/AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Actions/SignIn/DeviceSRPAuth/VerifyDevicePasswordSRP.swift
@@ -33,6 +33,10 @@ struct VerifyDevicePasswordSRP: Action {
             let secretBlock = try secretBlock(secretBlockString)
             let serverPublicB = try serverPublic(parameters)
 
+            let asfDeviceId = try await CognitoUserPoolASF.asfDeviceID(
+                for: username,
+                credentialStoreClient: environment.authEnvironment().credentialsClient)
+
             let deviceMetadata = await DeviceMetadataHelper.getDeviceMetadata(
                 for: username,
                 with: environment)
@@ -62,6 +66,7 @@ struct VerifyDevicePasswordSRP: Action {
                 secretBlock: secretBlockString,
                 signature: signature,
                 deviceMetadata: deviceMetadata,
+                asfDeviceId: asfDeviceId,
                 environment: userPoolEnv)
 
             let responseEvent = try await UserPoolSignInHelper.sendRespondToAuth(
diff --git a/AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Actions/SignIn/SRPAuth/VerifyPasswordSRP.swift b/AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Actions/SignIn/SRPAuth/VerifyPasswordSRP.swift
@@ -41,6 +41,10 @@ struct VerifyPasswordSRP: Action {
             let secretBlock = try secretBlock(secretBlockString)
             let serverPublicB = try serverPublic(parameters)
 
+            let asfDeviceId = try await CognitoUserPoolASF.asfDeviceID(
+                for: username,
+                credentialStoreClient: environment.authEnvironment().credentialsClient)
+
             deviceMetadata = await DeviceMetadataHelper.getDeviceMetadata(
                 for: username,
                 with: environment)
@@ -57,6 +61,7 @@ struct VerifyPasswordSRP: Action {
                 secretBlock: secretBlockString,
                 signature: signature,
                 deviceMetadata: deviceMetadata,
+                asfDeviceId: asfDeviceId,
                 environment: userPoolEnv)
             let responseEvent = try await UserPoolSignInHelper.sendRespondToAuth(
                 request: request,
diff --git a/AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Actions/SignIn/VerifySignInChallenge.swift b/AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Actions/SignIn/VerifySignInChallenge.swift
@@ -31,6 +31,10 @@ struct VerifySignInChallenge: Action {
             let challengeType = challenge.challenge
             let responseKey = try challenge.getChallengeKey()
 
+            let asfDeviceId = try await CognitoUserPoolASF.asfDeviceID(
+                for: username,
+                credentialStoreClient: environment.authEnvironment().credentialsClient)
+
             deviceMetadata = await DeviceMetadataHelper.getDeviceMetadata(
                             for: username,
                             with: environment)
@@ -42,6 +46,7 @@ struct VerifySignInChallenge: Action {
                 responseKey: responseKey,
                 answer: confirmSignEventData.answer,
                 clientMetadata: confirmSignEventData.metadata,
+                asfDeviceId: asfDeviceId,
                 attributes: confirmSignEventData.attributes,
                 deviceMetadata: deviceMetadata,
                 environment: userpoolEnv)
diff --git a/AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Support/Utils/ConfirmSignUpInput+Amplify.swift b/AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Support/Utils/ConfirmSignUpInput+Amplify.swift
@@ -12,7 +12,7 @@ extension ConfirmSignUpInput {
     init(username: String,
          confirmationCode: String,
          clientMetadata: [String: String]?,
-         asfDeviceId: String? = nil,
+         asfDeviceId: String?,
          environment: UserPoolEnvironment
     ) {
 
@@ -38,6 +38,7 @@ extension ConfirmSignUpInput {
             clientMetadata: clientMetadata,
             confirmationCode: confirmationCode,
             secretHash: secretHash,
-            userContextData: userContextData, username: username)
+            userContextData: userContextData,
+            username: username)
     }
 }
diff --git a/AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Support/Utils/InitiateAuthInput+Amplify.swift b/AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Support/Utils/InitiateAuthInput+Amplify.swift
@@ -100,7 +100,7 @@ extension InitiateAuthInput {
                            authFlowType: CognitoIdentityProviderClientTypes.AuthFlowType,
                            authParameters: [String: String],
                            clientMetadata: [String: String],
-                           asfDeviceId: String? = nil,
+                           asfDeviceId: String?,
                            deviceMetadata: DeviceMetadata,
                            environment: UserPoolEnvironment) -> InitiateAuthInput {
 
diff --git a/AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Support/Utils/RespondToAuthChallengeInput+Amplify.swift b/AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Support/Utils/RespondToAuthChallengeInput+Amplify.swift
@@ -16,6 +16,7 @@ extension RespondToAuthChallengeInput {
                                  secretBlock: String,
                                  signature: String,
                                  deviceMetadata: DeviceMetadata,
+                                 asfDeviceId: String?,
                                  environment: UserPoolEnvironment) -> RespondToAuthChallengeInput {
         let dateStr = stateData.clientTimestamp.utcString
         let challengeResponses = [
@@ -29,13 +30,15 @@ extension RespondToAuthChallengeInput {
             challengeResponses: challengeResponses,
             session: session,
             clientMetadata: [:],
+            asfDeviceId: asfDeviceId,
             deviceMetadata: deviceMetadata,
             environment: environment)
     }
 
     static func deviceSRP(username: String,
                           environment: UserPoolEnvironment,
                           deviceMetadata: DeviceMetadata,
+                          asfDeviceId: String?,
                           session: String?,
                           publicHexValue: String) -> RespondToAuthChallengeInput {
         let challengeResponses = [
@@ -48,6 +51,7 @@ extension RespondToAuthChallengeInput {
             challengeResponses: challengeResponses,
             session: session,
             clientMetadata: [:],
+            asfDeviceId: asfDeviceId,
             deviceMetadata: deviceMetadata,
             environment: environment)
     }
@@ -58,6 +62,7 @@ extension RespondToAuthChallengeInput {
                                        secretBlock: String,
                                        signature: String,
                                        deviceMetadata: DeviceMetadata,
+                                       asfDeviceId: String?,
                                        environment: UserPoolEnvironment)
     -> RespondToAuthChallengeInput {
         let dateStr = stateData.clientTimestamp.utcString
@@ -72,6 +77,7 @@ extension RespondToAuthChallengeInput {
             challengeResponses: challengeResponses,
             session: session,
             clientMetadata: [:],
+            asfDeviceId: asfDeviceId,
             deviceMetadata: deviceMetadata,
             environment: environment)
     }
@@ -83,6 +89,7 @@ extension RespondToAuthChallengeInput {
         responseKey: String,
         answer: String,
         clientMetadata: [String: String]?,
+        asfDeviceId: String?,
         attributes: [String: String],
         deviceMetadata: DeviceMetadata,
         environment: UserPoolEnvironment) -> RespondToAuthChallengeInput {
@@ -102,6 +109,7 @@ extension RespondToAuthChallengeInput {
                 challengeResponses: challengeResponses,
                 session: session,
                 clientMetadata: clientMetadata ?? [:],
+                asfDeviceId: asfDeviceId,
                 deviceMetadata: deviceMetadata,
                 environment: environment)
         }
@@ -112,7 +120,7 @@ extension RespondToAuthChallengeInput {
         challengeResponses: [String: String],
         session: String?,
         clientMetadata: [String: String],
-        asfDeviceId: String? = nil,
+        asfDeviceId: String?,
         deviceMetadata: DeviceMetadata,
         environment: UserPoolEnvironment) -> RespondToAuthChallengeInput {
             var challengeResponses = challengeResponses
diff --git a/AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Support/Utils/SignUpInput+Amplify.swift b/AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Support/Utils/SignUpInput+Amplify.swift
@@ -18,7 +18,7 @@ extension SignUpInput {
          clientMetadata: [String: String]?,
          validationData: [String: String]?,
          attributes: [String: String],
-         asfDeviceId: String? = nil,
+         asfDeviceId: String?,
          environment: UserPoolEnvironment) {
 
         let configuration = environment.userPoolConfiguration
diff --git a/AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Support/Utils/SignUpPasswordValidator.swift b/AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Support/Utils/SignUpPasswordValidator.swift
diff --git a/AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Task/AWSAuthConfirmSignUpTask.swift b/AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Task/AWSAuthConfirmSignUpTask.swift
@@ -28,11 +28,16 @@ class AWSAuthConfirmSignUpTask: AuthConfirmSignUpTask, DefaultLogger {
         try request.hasError()
         let userPoolEnvironment = authEnvironment.userPoolEnvironment
         do {
+
+            let asfDeviceId = try await CognitoUserPoolASF.asfDeviceID(
+                for: request.username,
+                credentialStoreClient: authEnvironment.credentialsClient)
             let metadata = (request.options.pluginOptions as? AWSAuthConfirmSignUpOptions)?.metadata
             let client = try userPoolEnvironment.cognitoUserPoolFactory()
             let input = ConfirmSignUpInput(username: request.username,
                                            confirmationCode: request.code,
                                            clientMetadata: metadata,
+                                           asfDeviceId: asfDeviceId,
                                            environment: userPoolEnvironment)
             _ = try await client.confirmSignUp(input: input)
             log.verbose("Received success")
diff --git a/AmplifyPlugins/Auth/Tests/AWSCognitoAuthPluginUnitTests/ResolverTests/SignUpState/ConfirmSignUpInputTests.swift b/AmplifyPlugins/Auth/Tests/AWSCognitoAuthPluginUnitTests/ResolverTests/SignUpState/ConfirmSignUpInputTests.swift
@@ -0,0 +1,63 @@
+//
+// Copyright Amazon.com Inc. or its affiliates.
+// All Rights Reserved.
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+
+import XCTest
+
+@testable import AWSCognitoAuthPlugin
+
+import AWSCognitoIdentityProvider
+
+class ConfirmSignUpInputTests: XCTestCase {
+
+    func testConfirmSignUpInputWithClientSecretAndAsfDeviceId() throws {
+        let username = "jeff"
+        let clientSecret = UUID().uuidString
+        let userPoolConfiguration = UserPoolConfigurationData(poolId: "",
+                                                              clientId: "123456",
+                                                              region: "",
+                                                              clientSecret: clientSecret)
+        let environment = BasicUserPoolEnvironment(
+            userPoolConfiguration: userPoolConfiguration,
+            cognitoUserPoolFactory: Defaults.makeDefaultUserPool,
+            cognitoUserPoolASFFactory: Defaults.makeDefaultASF,
+            cognitoUserPoolAnalyticsHandlerFactory: Defaults.makeUserPoolAnalytics)
+
+        let confirmSignUpInput = ConfirmSignUpInput(
+            username: username,
+            confirmationCode: "123",
+            clientMetadata: [:],
+            asfDeviceId: "asdfDeviceId",
+            environment: environment)
+
+        XCTAssertNotNil(confirmSignUpInput.secretHash)
+        XCTAssertNotNil(confirmSignUpInput.userContextData)
+    }
+
+    func testConfirmSignUpInputWithoutClientSecretAndAsfDeviceId() throws {
+        let username = "jeff"
+
+        let userPoolConfiguration = UserPoolConfigurationData(poolId: "",
+                                                              clientId: "123456",
+                                                              region: "",
+                                                              clientSecret: nil)
+        let environment = BasicUserPoolEnvironment(
+            userPoolConfiguration: userPoolConfiguration,
+            cognitoUserPoolFactory: Defaults.makeDefaultUserPool,
+            cognitoUserPoolASFFactory: Defaults.makeDefaultASF,
+            cognitoUserPoolAnalyticsHandlerFactory: Defaults.makeUserPoolAnalytics)
+
+        let confirmSignUpInput = ConfirmSignUpInput(
+            username: username,
+            confirmationCode: "123",
+            clientMetadata: [:],
+            asfDeviceId: nil,
+            environment: environment)
+
+        XCTAssertNil(confirmSignUpInput.secretHash)
+        XCTAssertNil(confirmSignUpInput.userContextData)
+    }
+}
diff --git a/AmplifyPlugins/Auth/Tests/AWSCognitoAuthPluginUnitTests/ResolverTests/SignUpState/RespondToAuthInputTests.swift b/AmplifyPlugins/Auth/Tests/AWSCognitoAuthPluginUnitTests/ResolverTests/SignUpState/RespondToAuthInputTests.swift
@@ -0,0 +1,125 @@
+//
+// Copyright Amazon.com Inc. or its affiliates.
+// All Rights Reserved.
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+
+import XCTest
+
+@testable import AWSCognitoAuthPlugin
+
+import AWSCognitoIdentityProvider
+
+class RespondToAuthInputTests: XCTestCase {
+
+    func testDevicePasswordVerifierInput() throws {
+        let username = "jeff"
+        let clientSecret = UUID().uuidString
+        let userPoolConfiguration = UserPoolConfigurationData(poolId: "",
+                                                              clientId: "123456",
+                                                              region: "",
+                                                              clientSecret: clientSecret)
+        let environment = BasicUserPoolEnvironment(
+            userPoolConfiguration: userPoolConfiguration,
+            cognitoUserPoolFactory: Defaults.makeDefaultUserPool,
+            cognitoUserPoolASFFactory: Defaults.makeDefaultASF,
+            cognitoUserPoolAnalyticsHandlerFactory: Defaults.makeUserPoolAnalytics)
+
+        let respondToAuthChallengeInput = RespondToAuthChallengeInput.devicePasswordVerifier(
+            username: username,
+            stateData: .testData,
+            session: "session",
+            secretBlock: "secret",
+            signature: "signature",
+            deviceMetadata: .metadata(.init(deviceKey: "", deviceGroupKey: "")),
+            asfDeviceId: "asfDeviceId",
+            environment: environment)
+
+        XCTAssertNotNil(respondToAuthChallengeInput.challengeResponses?["SECRET_HASH"])
+        XCTAssertNotNil(respondToAuthChallengeInput.userContextData)
+    }
+
+    func testVerifyChallengeInput() throws {
+        let username = "jeff"
+        let clientSecret = UUID().uuidString
+        let userPoolConfiguration = UserPoolConfigurationData(poolId: "",
+                                                              clientId: "123456",
+                                                              region: "",
+                                                              clientSecret: clientSecret)
+        let environment = BasicUserPoolEnvironment(
+            userPoolConfiguration: userPoolConfiguration,
+            cognitoUserPoolFactory: Defaults.makeDefaultUserPool,
+            cognitoUserPoolASFFactory: Defaults.makeDefaultASF,
+            cognitoUserPoolAnalyticsHandlerFactory: Defaults.makeUserPoolAnalytics)
+
+        let respondToAuthChallengeInput = RespondToAuthChallengeInput.verifyChallenge(
+            username: username,
+            challengeType: .smsMfa,
+            session: "session",
+            responseKey: "CODE",
+            answer: "1234",
+            clientMetadata: [:],
+            asfDeviceId: "asfDeviceId",
+            attributes: [:],
+            deviceMetadata: .metadata(.init(deviceKey: "", deviceGroupKey: "")),
+            environment: environment)
+
+        XCTAssertEqual(respondToAuthChallengeInput.challengeResponses?["CODE"], "1234")
+        XCTAssertNotNil(respondToAuthChallengeInput.userContextData)
+    }
+
+    func testPasswordVerifierInput() throws {
+        let username = "jeff"
+        let clientSecret = UUID().uuidString
+        let userPoolConfiguration = UserPoolConfigurationData(poolId: "",
+                                                              clientId: "123456",
+                                                              region: "",
+                                                              clientSecret: clientSecret)
+        let environment = BasicUserPoolEnvironment(
+            userPoolConfiguration: userPoolConfiguration,
+            cognitoUserPoolFactory: Defaults.makeDefaultUserPool,
+            cognitoUserPoolASFFactory: Defaults.makeDefaultASF,
+            cognitoUserPoolAnalyticsHandlerFactory: Defaults.makeUserPoolAnalytics)
+
+        let respondToAuthChallengeInput = RespondToAuthChallengeInput.passwordVerifier(
+            username: username,
+            stateData: .testData,
+            session: "session",
+            secretBlock: "secret",
+            signature: "signature",
+            deviceMetadata: .metadata(.init(deviceKey: "", deviceGroupKey: "")),
+            asfDeviceId: "asfDeviceId",
+            environment: environment)
+
+        XCTAssertNotNil(respondToAuthChallengeInput.challengeResponses?["PASSWORD_CLAIM_SECRET_BLOCK"])
+        XCTAssertNotNil(respondToAuthChallengeInput.challengeResponses?["PASSWORD_CLAIM_SIGNATURE"])
+        XCTAssertNotNil(respondToAuthChallengeInput.userContextData)
+    }
+
+    func testDeviceSrpInput() throws {
+        let username = "jeff"
+        let clientSecret = UUID().uuidString
+        let userPoolConfiguration = UserPoolConfigurationData(poolId: "",
+                                                              clientId: "123456",
+                                                              region: "",
+                                                              clientSecret: clientSecret)
+        let environment = BasicUserPoolEnvironment(
+            userPoolConfiguration: userPoolConfiguration,
+            cognitoUserPoolFactory: Defaults.makeDefaultUserPool,
+            cognitoUserPoolASFFactory: Defaults.makeDefaultASF,
+            cognitoUserPoolAnalyticsHandlerFactory: Defaults.makeUserPoolAnalytics)
+
+        let respondToAuthChallengeInput = RespondToAuthChallengeInput.deviceSRP(
+            username: username,
+            environment: environment,
+            deviceMetadata: .metadata(.init(deviceKey: "", deviceGroupKey: "")),
+            asfDeviceId: "asfDeviceId",
+            session: "session",
+            publicHexValue: "somehexValue")
+
+        XCTAssertEqual(respondToAuthChallengeInput.challengeResponses?["SRP_A"], "somehexValue")
+        XCTAssertNotNil(respondToAuthChallengeInput.userContextData)
+    }
+
+}
diff --git a/AmplifyPlugins/Auth/Tests/AWSCognitoAuthPluginUnitTests/ResolverTests/SignUpState/SignUpInputTests.swift b/AmplifyPlugins/Auth/Tests/AWSCognitoAuthPluginUnitTests/ResolverTests/SignUpState/SignUpInputTests.swift
