diff --git a/packages/auth/__tests__/providers/cognito/signInWithRedirect.test.ts b/packages/auth/__tests__/providers/cognito/signInWithRedirect.test.ts index 0714c091278..fcbd01de66a 100644 --- a/packages/auth/__tests__/providers/cognito/signInWithRedirect.test.ts +++ b/packages/auth/__tests__/providers/cognito/signInWithRedirect.test.ts @@ -157,7 +157,7 @@ describe('signInWithRedirect', () => { const [oauthUrl, redirectSignIn, preferPrivateSession] = mockOpenAuthSession.mock.calls[0]; expect(oauthUrl).toStrictEqual( - 'https://oauth.domain.com/oauth2/authorize?redirect_uri=http%3A%2F%2Flocalhost%3A3000%2F&response_type=code&client_id=userPoolClientId&identity_provider=Google&scope=phone%20email%20openid%20profile%20aws.cognito.signin.user.admin&state=oauth_state&code_challenge=code_challenge&code_challenge_method=S256', + 'https://oauth.domain.com/oauth2/authorize?prompt=none&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2F&response_type=code&client_id=userPoolClientId&identity_provider=Google&scope=phone%20email%20openid%20profile%20aws.cognito.signin.user.admin&state=oauth_state&code_challenge=code_challenge&code_challenge_method=S256', ); expect(redirectSignIn).toEqual( mockAuthConfigWithOAuth.Auth.Cognito.loginWith.oauth.redirectSignIn, @@ -170,7 +170,7 @@ describe('signInWithRedirect', () => { await signInWithRedirect(); const [oauthUrl] = mockOpenAuthSession.mock.calls[0]; expect(oauthUrl).toStrictEqual( - `https://oauth.domain.com/oauth2/authorize?redirect_uri=http%3A%2F%2Flocalhost%3A3000%2F&response_type=code&client_id=userPoolClientId&identity_provider=${expectedDefaultProvider}&scope=phone%20email%20openid%20profile%20aws.cognito.signin.user.admin&state=oauth_state&code_challenge=code_challenge&code_challenge_method=S256`, + `https://oauth.domain.com/oauth2/authorize?prompt=none&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2F&response_type=code&client_id=userPoolClientId&identity_provider=${expectedDefaultProvider}&scope=phone%20email%20openid%20profile%20aws.cognito.signin.user.admin&state=oauth_state&code_challenge=code_challenge&code_challenge_method=S256`, ); }); @@ -179,7 +179,7 @@ describe('signInWithRedirect', () => { await signInWithRedirect({ provider: { custom: expectedCustomProvider } }); const [oauthUrl] = mockOpenAuthSession.mock.calls[0]; expect(oauthUrl).toStrictEqual( - `https://oauth.domain.com/oauth2/authorize?redirect_uri=http%3A%2F%2Flocalhost%3A3000%2F&response_type=code&client_id=userPoolClientId&identity_provider=${expectedCustomProvider}&scope=phone%20email%20openid%20profile%20aws.cognito.signin.user.admin&state=oauth_state&code_challenge=code_challenge&code_challenge_method=S256`, + `https://oauth.domain.com/oauth2/authorize?prompt=none&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2F&response_type=code&client_id=userPoolClientId&identity_provider=${expectedCustomProvider}&scope=phone%20email%20openid%20profile%20aws.cognito.signin.user.admin&state=oauth_state&code_challenge=code_challenge&code_challenge_method=S256`, ); }); @@ -189,6 +189,18 @@ describe('signInWithRedirect', () => { expect(mockUrlSafeEncode).toHaveBeenCalledWith(expectedCustomState); }); + it('uses "login" as the prompt query param value to when require sign in is true', async () => { + const expectedCustomProvider = 'PieAuth'; + await signInWithRedirect({ + provider: { custom: expectedCustomProvider }, + options: { requireSignIn: true }, + }); + const [oauthUrl] = mockOpenAuthSession.mock.calls[0]; + expect(oauthUrl).toStrictEqual( + `https://oauth.domain.com/oauth2/authorize?prompt=login&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2F&response_type=code&client_id=userPoolClientId&identity_provider=${expectedCustomProvider}&scope=phone%20email%20openid%20profile%20aws.cognito.signin.user.admin&state=oauth_state&code_challenge=code_challenge&code_challenge_method=S256`, + ); + }); + describe('specifications on Web', () => { describe('side effect', () => { it('attaches oauth listener to the Amplify singleton', async () => { @@ -324,7 +336,7 @@ describe('signInWithRedirect', () => { mockOpenAuthSession.mock.calls[0]; expect(oauthUrl).toStrictEqual( - 'https://oauth.domain.com/oauth2/authorize?redirect_uri=http%3A%2F%2Flocalhost%3A3000%2F&response_type=code&client_id=userPoolClientId&identity_provider=Google&scope=phone%20email%20openid%20profile%20aws.cognito.signin.user.admin&login_hint=someone%40gmail.com&lang=en&nonce=88388838883&state=oauth_state&code_challenge=code_challenge&code_challenge_method=S256', + 'https://oauth.domain.com/oauth2/authorize?prompt=none&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2F&response_type=code&client_id=userPoolClientId&identity_provider=Google&scope=phone%20email%20openid%20profile%20aws.cognito.signin.user.admin&login_hint=someone%40gmail.com&lang=en&nonce=88388838883&state=oauth_state&code_challenge=code_challenge&code_challenge_method=S256', ); expect(redirectSignIn).toEqual( mockAuthConfigWithOAuth.Auth.Cognito.loginWith.oauth.redirectSignIn, diff --git a/packages/auth/src/providers/cognito/apis/signInWithRedirect.ts b/packages/auth/src/providers/cognito/apis/signInWithRedirect.ts index bac92589dc8..0e666e24926 100644 --- a/packages/auth/src/providers/cognito/apis/signInWithRedirect.ts +++ b/packages/auth/src/providers/cognito/apis/signInWithRedirect.ts @@ -55,6 +55,7 @@ export async function signInWithRedirect( oauthConfig: authConfig.loginWith.oauth, clientId: authConfig.userPoolClientId, provider, + requireSignIn: input?.options?.requireSignIn, customState: input?.customState, preferPrivateSession: input?.options?.preferPrivateSession, options: { @@ -69,6 +70,7 @@ const oauthSignIn = async ({ oauthConfig, provider, clientId, + requireSignIn, customState, preferPrivateSession, options, @@ -76,6 +78,7 @@ const oauthSignIn = async ({ oauthConfig: OAuthConfig; provider: string; clientId: string; + requireSignIn?: boolean; customState?: string; preferPrivateSession?: boolean; options?: SignInWithRedirectInput['options']; @@ -102,6 +105,7 @@ const oauthSignIn = async ({ oAuthStore.storePKCE(value); const queryString = Object.entries({ + prompt: requireSignIn ? 'login' : 'none', redirect_uri: redirectUri, response_type: responseType, client_id: clientId, diff --git a/packages/auth/src/types/inputs.ts b/packages/auth/src/types/inputs.ts index 81ea27e6b88..04076346e41 100644 --- a/packages/auth/src/types/inputs.ts +++ b/packages/auth/src/types/inputs.ts @@ -95,6 +95,12 @@ export interface AuthSignInWithRedirectInput { * @see https://docs.aws.amazon.com/cognito/latest/developerguide/authorization-endpoint.html */ nonce?: string; + + /** + * A flag to use if you want to force the user to sign in again or view the account selector screen. + * @see https://docs.aws.amazon.com/cognito/latest/developerguide/authorization-endpoint.html + */ + requireSignIn?: boolean; }; }