{"version":3,"file":"handleSignInCallbackRequestForPagesRouter.mjs","sources":["../../../../src/auth/handlers/handleSignInCallbackRequestForPagesRouter.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { PKCE_COOKIE_NAME, SIGN_IN_TIMEOUT_ERROR_CODE, SIGN_IN_TIMEOUT_ERROR_MESSAGE, STATE_COOKIE_NAME, } from '../constant';\nimport { appendSetCookieHeadersToNextApiResponse, createAuthFlowProofCookiesRemoveOptions, createErrorSearchParamsString, createRedirectionIntermediary, createSignInFlowProofCookies, createTokenCookies, createTokenCookiesSetOptions, exchangeAuthNTokens, getCookieValuesFromNextApiRequest, getRedirectOrDefault, parseSignInCallbackUrl, resolveRedirectSignInUrl, } from '../utils';\nexport const handleSignInCallbackRequestForPagesRouter = async ({ request, response, handlerInput, userPoolClientId, oAuthConfig, setCookieOptions, origin, }) => {\n    const { code, state, error, errorDescription } = parseSignInCallbackUrl(request.url);\n    if (errorDescription || error) {\n        const searchParamsString = createErrorSearchParamsString({\n            error,\n            errorDescription,\n        });\n        response.redirect(302, `${getRedirectOrDefault(handlerInput.redirectOnSignOutComplete)}?${searchParamsString}`);\n        return;\n    }\n    if (!code || !state) {\n        response.status(400).end();\n        return;\n    }\n    const { [PKCE_COOKIE_NAME]: clientPkce, [STATE_COOKIE_NAME]: clientState } = getCookieValuesFromNextApiRequest(request, [\n        PKCE_COOKIE_NAME,\n        STATE_COOKIE_NAME,\n    ]);\n    // The state and pkce cookies are removed from cookie store after 5 minutes\n    if (!clientState || !clientPkce) {\n        const searchParamsString = createErrorSearchParamsString({\n            error: SIGN_IN_TIMEOUT_ERROR_CODE,\n            errorDescription: SIGN_IN_TIMEOUT_ERROR_MESSAGE,\n        });\n        response.redirect(302, `${getRedirectOrDefault(handlerInput.redirectOnSignOutComplete)}?${searchParamsString}`);\n        return;\n    }\n    // Most likely the cookie has been tampered\n    if (clientState !== state) {\n        response.status(400).end();\n        return;\n    }\n    const tokensPayload = await exchangeAuthNTokens({\n        redirectUri: resolveRedirectSignInUrl(origin, oAuthConfig),\n        userPoolClientId,\n        oAuthConfig,\n        code,\n        codeVerifier: clientPkce,\n    });\n    if ('error' in tokensPayload) {\n        response.status(500).send(tokensPayload.error);\n        return;\n    }\n    appendSetCookieHeadersToNextApiResponse(response, createTokenCookies({\n        tokensPayload,\n        userPoolClientId,\n    }), createTokenCookiesSetOptions(setCookieOptions, origin));\n    appendSetCookieHeadersToNextApiResponse(response, createSignInFlowProofCookies({ state: '', pkce: '' }), createAuthFlowProofCookiesRemoveOptions(setCookieOptions));\n    // When Cognito redirects back to `/sign-in-callback`, the referer is Cognito\n    // endpoint. If redirect end user to `redirectOnSignInComplete` from this point,\n    // the referer remains the same.\n    // When authN token cookies set as `sameSite: 'strict'`, this may cause the\n    // authN tokens cookies set with the redirect response not to be sent to the\n    // server. Hence, sending a html page with status 200 to the client, and perform\n    // the redirection on the client side.\n    response\n        .appendHeader('Content-Type', 'text/html')\n        .status(200)\n        .send(createRedirectionIntermediary({\n        redirectTo: getRedirectOrDefault(handlerInput.redirectOnSignInComplete),\n    }));\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA;AACA;AAGY,MAAC,yCAAyC,GAAG,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,GAAG,KAAK;AAClK,IAAI,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC;AACxF,IAAI,IAAI,gBAAgB,IAAI,KAAK,EAAE;AACnC,QAAQ,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AACjE,YAAY,KAAK;AACjB,YAAY,gBAAgB;AAC5B,SAAS,CAAC;AACV,QAAQ,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,EAAE,oBAAoB,CAAC,YAAY,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC;AACvH,QAAQ;AACR,IAAI;AACJ,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE;AACzB,QAAQ,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE;AAClC,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,EAAE,CAAC,gBAAgB,GAAG,UAAU,EAAE,CAAC,iBAAiB,GAAG,WAAW,EAAE,GAAG,iCAAiC,CAAC,OAAO,EAAE;AAC5H,QAAQ,gBAAgB;AACxB,QAAQ,iBAAiB;AACzB,KAAK,CAAC;AACN;AACA,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,EAAE;AACrC,QAAQ,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AACjE,YAAY,KAAK,EAAE,0BAA0B;AAC7C,YAAY,gBAAgB,EAAE,6BAA6B;AAC3D,SAAS,CAAC;AACV,QAAQ,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,EAAE,oBAAoB,CAAC,YAAY,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC;AACvH,QAAQ;AACR,IAAI;AACJ;AACA,IAAI,IAAI,WAAW,KAAK,KAAK,EAAE;AAC/B,QAAQ,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE;AAClC,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC;AACpD,QAAQ,WAAW,EAAE,wBAAwB,CAAC,MAAM,EAAE,WAAW,CAAC;AAClE,QAAQ,gBAAgB;AACxB,QAAQ,WAAW;AACnB,QAAQ,IAAI;AACZ,QAAQ,YAAY,EAAE,UAAU;AAChC,KAAK,CAAC;AACN,IAAI,IAAI,OAAO,IAAI,aAAa,EAAE;AAClC,QAAQ,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;AACtD,QAAQ;AACR,IAAI;AACJ,IAAI,uCAAuC,CAAC,QAAQ,EAAE,kBAAkB,CAAC;AACzE,QAAQ,aAAa;AACrB,QAAQ,gBAAgB;AACxB,KAAK,CAAC,EAAE,4BAA4B,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;AAC/D,IAAI,uCAAuC,CAAC,QAAQ,EAAE,4BAA4B,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,uCAAuC,CAAC,gBAAgB,CAAC,CAAC;AACvK;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI;AACJ,SAAS,YAAY,CAAC,cAAc,EAAE,WAAW;AACjD,SAAS,MAAM,CAAC,GAAG;AACnB,SAAS,IAAI,CAAC,6BAA6B,CAAC;AAC5C,QAAQ,UAAU,EAAE,oBAAoB,CAAC,YAAY,CAAC,wBAAwB,CAAC;AAC/E,KAAK,CAAC,CAAC;AACP;;;;"}