Class CognitoAdminClient

Admin reads and writes on one user pool, for provisioning. Credentials come from the environment.

Constructors

constructor

new CognitoAdminClient(
    __namedParameters: {
        client?: CognitoIdentityProviderClient;
        userPoolId: string;
    },
): CognitoAdminClient
Parameters
- __namedParameters: { client?: CognitoIdentityProviderClient; userPoolId: string }
Returns CognitoAdminClient
- Defined in packages/dashboard-auth-services/src/clients/cognito/CognitoAdminClient.ts:131

Methods

addClientIdentityProvider

addClientIdentityProvider(
__namedParameters: { clientId: string; providerName: string },
): Promise<{ ok: true; value: void }>
Offers the IdP on the app client's sign-in; a no-op when it already is.
Parameters
- __namedParameters: { clientId: string; providerName: string }
Returns Promise<{ ok: true; value: void }>
- Defined in packages/dashboard-auth-services/src/clients/cognito/CognitoAdminClient.ts:468

addClientRedirect

addClientRedirect(
    __namedParameters: {
        callbackUrl: string;
        clientId: string;
        logoutUrl: string;
    },
): Promise<{ ok: true; value: void }>
Lets sign-in return to callbackUrl and sign-out land on logoutUrl; a no-op when both already do.
Parameters
- __namedParameters: { callbackUrl: string; clientId: string; logoutUrl: string }
Returns Promise<{ ok: true; value: void }>
- Defined in packages/dashboard-auth-services/src/clients/cognito/CognitoAdminClient.ts:503

createIdentityProvider

createIdentityProvider(
    __namedParameters: {
        config: CognitoIdentityProviderConfig;
        domains: string[];
        providerName: string;
    },
): Promise<
    | { ok: true; value: CognitoIdentityProvider }
    | { error: CognitoProviderError; ok: false },
>
A SAML or OIDC IdP whose IdpIdentifiers are domains, so managed login routes those email domains to it, mapped by tenantAttributeMapping.
Parameters
- __namedParameters: {
      config: CognitoIdentityProviderConfig;
      domains: string[];
      providerName: string;
  }
Returns Promise<
| { ok: true; value: CognitoIdentityProvider }
| { error: CognitoProviderError; ok: false },
>
- Defined in packages/dashboard-auth-services/src/clients/cognito/CognitoAdminClient.ts:385

createUser

createUser(
    __namedParameters: { email: string },
): Promise<
    { ok: true; value: CognitoUser }
    | { error: ServiceError; ok: false },
>
A passwordless user with a verified email; no invitation is sent and no phone is set. USERNAME_EXISTS when the pool already has the address.
Parameters
- __namedParameters: { email: string }
Returns Promise<{ ok: true; value: CognitoUser } | { error: ServiceError; ok: false }>
- Defined in packages/dashboard-auth-services/src/clients/cognito/CognitoAdminClient.ts:349

deleteIdentityProvider

deleteIdentityProvider(
__namedParameters: { providerName: string },
): Promise<{ ok: true; value: void } | { error: ServiceError; ok: false }>
IDENTITY_PROVIDER_NOT_FOUND when the pool has no such IdP: already deleted.
Parameters
- __namedParameters: { providerName: string }
Returns Promise<{ ok: true; value: void } | { error: ServiceError; ok: false }>
- Defined in packages/dashboard-auth-services/src/clients/cognito/CognitoAdminClient.ts:444

deleteSoftwareToken

deleteSoftwareToken(
__namedParameters: { username: string },
): Promise<{ ok: true; value: void } | { error: ServiceError; ok: false }>
Deletes the user's authenticator app (AdminDeleteSoftwareToken); their other factors stay. NO_AUTHENTICATOR when they have none registered.
Parameters
- __namedParameters: { username: string }
Returns Promise<{ ok: true; value: void } | { error: ServiceError; ok: false }>
- Defined in packages/dashboard-auth-services/src/clients/cognito/CognitoAdminClient.ts:208

disableProviderForUser

disableProviderForUser(
__namedParameters: CognitoLinkedIdentity,
): Promise<{ ok: true; value: void }>
Unlinks one IdP identity from the user it is linked to (AdminDisableProviderForUser).
Parameters
- __namedParameters: CognitoLinkedIdentity
Returns Promise<{ ok: true; value: void }>
- Defined in packages/dashboard-auth-services/src/clients/cognito/CognitoAdminClient.ts:312

disableUser

disableUser(
__namedParameters: { username: string },
): Promise<{ ok: true; value: void }>
Stops the user signing in and revokes their access tokens (AdminDisableUser).
Parameters
- __namedParameters: { username: string }
Returns Promise<{ ok: true; value: void }>
- Defined in packages/dashboard-auth-services/src/clients/cognito/CognitoAdminClient.ts:233

enableUser

enableUser(
__namedParameters: { username: string },
): Promise<{ ok: true; value: void }>
Lets a disabled user sign in again (AdminEnableUser).
Parameters
- __namedParameters: { username: string }
Returns Promise<{ ok: true; value: void }>
- Defined in packages/dashboard-auth-services/src/clients/cognito/CognitoAdminClient.ts:244

getUserByEmail

getUserByEmail(email: string): Promise<CognitoUser | null>
The pool's user with exactly this email, or null. Two users on one email is a pool fault and throws.
Parameters
- email: string
Returns Promise<CognitoUser | null>
- Defined in packages/dashboard-auth-services/src/clients/cognito/CognitoAdminClient.ts:143

getUserSecurity

getUserSecurity(
__namedParameters: { username: string },
): Promise<CognitoUserSecurity | null>
The user's status (AdminGetUser), MFA factors and passkey (AdminGetUserAuthFactors), by the pool's own username; null when the pool has no such user.
Parameters
- __namedParameters: { username: string }
Returns Promise<CognitoUserSecurity | null>
- Defined in packages/dashboard-auth-services/src/clients/cognito/CognitoAdminClient.ts:175

getUserWithIdentities

getUserWithIdentities(
    by: { sub: string } | { email: string },
): Promise<
    | CognitoUser & {
        identities: CognitoLinkedIdentity[];
        username: string;
    }
    | null,
>
The user by sub or email, with its username and every IdP identity linked to it; null when none.
Parameters
- by: { sub: string } | { email: string }
Returns Promise<
    | CognitoUser & {
        identities: CognitoLinkedIdentity[];
        username: string;
    }
    | null,
>
- Defined in packages/dashboard-auth-services/src/clients/cognito/CognitoAdminClient.ts:149

globalSignOut

globalSignOut(
__namedParameters: { username: string },
): Promise<{ ok: true; value: void }>
Revokes every refresh token the user holds; issued access tokens stay valid until they expire.
Parameters
- __namedParameters: { username: string }
Returns Promise<{ ok: true; value: void }>
- Defined in packages/dashboard-auth-services/src/clients/cognito/CognitoAdminClient.ts:331

removeClientIdentityProvider

removeClientIdentityProvider(
__namedParameters: { clientId: string; providerName: string },
): Promise<{ ok: true; value: void }>
Withdraws the IdP from the app client's sign-in; a no-op when it is not offered.
Parameters
- __namedParameters: { clientId: string; providerName: string }
Returns Promise<{ ok: true; value: void }>
- Defined in packages/dashboard-auth-services/src/clients/cognito/CognitoAdminClient.ts:486

removeClientRedirect

removeClientRedirect(
    __namedParameters: {
        callbackUrl: string;
        clientId: string;
        logoutUrl: string;
    },
): Promise<{ ok: true; value: void }>
Withdraws callbackUrl and logoutUrl from the app client; a no-op when neither is listed.
Parameters
- __namedParameters: { callbackUrl: string; clientId: string; logoutUrl: string }
Returns Promise<{ ok: true; value: void }>
- Defined in packages/dashboard-auth-services/src/clients/cognito/CognitoAdminClient.ts:521

resendConfirmationCode

resendConfirmationCode(
    __namedParameters: {
        appClient: { authDomain: string; clientId: string };
        username: string;
    },
): Promise<
    { error: CognitoAuthError; ok: false }
    | { ok: true; value: void },
>
Emails an UNCONFIRMED user a new sign-up code, as the sign-in page's resend does, on appClient; the user still confirms it themselves.
Parameters
- __namedParameters: { appClient: { authDomain: string; clientId: string }; username: string }
Returns Promise<{ error: CognitoAuthError; ok: false } | { ok: true; value: void }>
- Defined in packages/dashboard-auth-services/src/clients/cognito/CognitoAdminClient.ts:274

sendPasswordSetupCode

sendPasswordSetupCode(
    __namedParameters: {
        appClient: { authDomain: string; clientId: string };
        username: string;
    },
): Promise<
    { error: CognitoAuthError; ok: false }
    | { ok: true; value: void },
>
The sign-in screens' own Forgot password (CognitoAuthClient.sendPasswordSetupCode) on appClient, with its secret read from the pool, so no second copy of the secret is kept. A federated login is sent nothing and answers ok.
Parameters
- __namedParameters: { appClient: { authDomain: string; clientId: string }; username: string }
Returns Promise<{ error: CognitoAuthError; ok: false } | { ok: true; value: void }>
- Defined in packages/dashboard-auth-services/src/clients/cognito/CognitoAdminClient.ts:259

updateIdentityProvider

updateIdentityProvider(
    __namedParameters: {
        config?: CognitoIdentityProviderConfig;
        domains: string[];
        providerName: string;
    },
): Promise<
    | { ok: true; value: CognitoIdentityProvider }
    | { error: CognitoProviderError; ok: false },
>
Always resends domains: the pre sign-up Lambda refuses any email outside the IdP's identifiers. config must keep the IdP's protocol, which Cognito cannot change; without it the provider details stay as they are.
Parameters
- __namedParameters: {
      config?: CognitoIdentityProviderConfig;
      domains: string[];
      providerName: string;
  }
Returns Promise<
| { ok: true; value: CognitoIdentityProvider }
| { error: CognitoProviderError; ok: false },
>
- Defined in packages/dashboard-auth-services/src/clients/cognito/CognitoAdminClient.ts:415

Class CognitoAdminClient

Index

Constructors

Methods

Constructors

constructor

Parameters

Returns CognitoAdminClient

Methods

addClientIdentityProvider

Parameters

Returns Promise<{ ok: true; value: void }>

addClientRedirect

Parameters

Returns Promise<{ ok: true; value: void }>

createIdentityProvider

Parameters

Returns Promise< | { ok: true; value: CognitoIdentityProvider } | { error: CognitoProviderError; ok: false },>

createUser

Parameters

Returns Promise<{ ok: true; value: CognitoUser } | { error: ServiceError; ok: false }>

deleteIdentityProvider

Parameters

Returns Promise<{ ok: true; value: void } | { error: ServiceError; ok: false }>

deleteSoftwareToken

Parameters

Returns Promise<{ ok: true; value: void } | { error: ServiceError; ok: false }>

disableProviderForUser

Parameters

Returns Promise<{ ok: true; value: void }>

disableUser

Parameters

Returns Promise<{ ok: true; value: void }>

enableUser

Parameters

Returns Promise<{ ok: true; value: void }>

getUserByEmail

Parameters

Returns Promise<CognitoUser | null>

getUserSecurity

Parameters

Returns Promise<CognitoUserSecurity | null>

getUserWithIdentities

Parameters

Returns Promise< | CognitoUser & { identities: CognitoLinkedIdentity[]; username: string; } | null,>

globalSignOut

Parameters

Returns Promise<{ ok: true; value: void }>

removeClientIdentityProvider

Parameters

Returns Promise<{ ok: true; value: void }>

removeClientRedirect

Parameters

Returns Promise<{ ok: true; value: void }>

resendConfirmationCode

Parameters

Returns Promise<{ error: CognitoAuthError; ok: false } | { ok: true; value: void }>

sendPasswordSetupCode

Parameters

Returns Promise<{ error: CognitoAuthError; ok: false } | { ok: true; value: void }>

updateIdentityProvider

Parameters

Returns Promise< | { ok: true; value: CognitoIdentityProvider } | { error: CognitoProviderError; ok: false },>

Settings

On This Page

Returns Promise<
| { ok: true; value: CognitoIdentityProvider }
| { error: CognitoProviderError; ok: false },
>

Returns Promise<
| CognitoUser & {
identities: CognitoLinkedIdentity[];
username: string;
}
| null,
>

Returns Promise<
| { ok: true; value: CognitoIdentityProvider }
| { error: CognitoProviderError; ok: false },
>