[harsh62]

Part 06 of 14 of the auth-unification stack (open parts: #851–#863) · stacked on auth/stack-05-native-fixtures (part 05, #854) · the stack is based on main @ 02cdf908, and part 01 (#850) is merged into main as 48c35f64 · next: #856 · reference PR #711 (closed) held the whole change in one commit.
Merge bottom to top. When the PR below merges, GitHub retargets this one to main.

Problem

The last patch of the current auth blocks, before anything moves off them. People who stay on AuthCognito or AuthOIDC get B6's security fixes (L7 option (a), decided by the maintainer).

Issue #, if available: see #711

Changes

• bb-auth-cognito security fixes:
  • the auto-sign-in cookie, which holds the encrypted sign-up password, is now actually cleared;
  • IAM and credential errors no longer reach the client;
  • an unknown user gets the same answer as a wrong password or a wrong code, on every pool including imported ones.
• Other bb-auth-cognito fixes: refreshed ID tokens are verified; block-raised errors keep their status; InternalErrorException is a retriable 500.
• Merged with main's fix(bb-auth-cognito): stop leaking raw Cognito SDK text in ApiError #678. Client messages stay the block's own fixed text per error name. The masking and IAM-denial logging from B6 sit on top of that, and the "unknown user" text is the same string as the wrong-code text, so the two can't be told apart.
• bb-auth-oidc: corrected cognitoFederated() docs. Cognito adds no MFA for federated users.
• Tests: offline tests for the Cognito AWS layer (B5), and resource-identity tripwires for both blocks (B1).
• auth-common: the canonical AuthErrors vocabulary and guards (including PasskeysNotEnabled and MfaNotEnabled), the shared auth-state store behind main's submitAuthAction (fix(auth-common): add submitAuthAction so setAuthState drives onAuthChange #208) with subscribeAuthState / getAuthStateSnapshot, cookie docs. AuthState<U> and AuthStateApi<I, U> take the user type, with defaults, and AuthUserOf names it. Sign-in and sign-out broadcasts are tagged with the API's RPC namespace, which core's client reports from part 07, so one auth API's onAuthChange doesn't get another's user; untagged messages still reach every API. requireRole is an optional member of BlocksAuth until the cutover (part 12).
• Changesets: six for the old packages, which release them as bb-auth-cognito 0.1.13 and bb-auth-oidc 0.2.3, plus auth-common's.

What to review closely: Please read packages/bb-auth-cognito/src/index.aws.ts (asApiError) and cookies.ts. Merge the Version Packages PR after this part, so the patch ships before parts 07–12.

Validation

Re-cut onto main @ 02cdf908. This branch passed on its own, from a fresh npm ci:

• npm ci
• build
• changeset-guard: its tests and all four checks
• comprehensive's tsc --noEmit
• every test app's tsc --noEmit, matching main's baseline: the same five apps fail as on main (amplify-gen2, extending-blocks-guide, hosting-ssr-nuxt, hosting-ssr-sveltekit, native-bindings), and no other
• the core and auth-common unit suites: 2,054 and 166 passed, 0 failed

Part 12's tree, which is the whole stack apart from the stack doc, also passed build, update:api, the fixture regeneration and the live auth-spec check with zero drift, comprehensive's tsc --noEmit, and npm test: 8,857 passed, 0 failed.

An earlier tree of the full stack passed end to end on AWS, on new stacks that were destroyed afterwards: upgrade-in-place from AuthCognito, comprehensive sandbox and production, hosting, native, and the CloudFront front door (see #711). That run came before the later merges of main (#824's synth guards, #797's Swift Blocks entry point, #834's template metadata, #835/#837's native opt-out warnings, #841, #749, #819 and dependency bumps, then #208's submitAuthAction, #807's Swift typed declared-binding results, #637's config-bucket hardening and more dependency bumps, then #736's per-namespace RPC paths, #574's ComputeBase, #910's native escaping, #704's Kotlin Blocks entry point, #907's Next.js 16, #927's hosting security headers and more, then #1042's sandbox-only stub IdP and getDeploymentType(), #1032's fail-closed mock entries, #510's swappable hosting front doors, #949, #827, #948's per-namespace compute and more, then this round's #1024, #1050, #1027's apiWaf, #1076, #962, #902's typed OIDCClient, #674 and more) and before the #856 review fixes.

The bench / summary check is not a required check. It currently fails repo-wide, on unrelated PRs too, because of runner isolation.

Checklist

• PR description included
• Tests are changed or added
• Relevant documentation is changed or added (and PR referenced)

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[changeset-bot]

🦋 Changeset detected

Latest commit: fc1a913

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 5 packages

Name	Type
@aws-blocks/bb-auth-cognito	Patch
@aws-blocks/blocks	Minor
@aws-blocks/auth-common	Minor
@aws-blocks/bb-auth-oidc	Patch
@aws-blocks/bb-auth-basic	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR