Type Alias CognitoSignInDeps

passkeyClient

recordPasskeyEnrollment

staffSignIn

totpIssuer

accountAccess

• accountAccess(): Promise<CognitoAccountAccess | null>

  The current session's access token, federated included; null without a session.

  Returns Promise<CognitoAccountAccess | null>

endSession

• endSession(): Promise<void>

  Ends the request's stored session and clears its cookies.

  Returns Promise<void>

findSsoProvider

• findSsoProvider(input: { email: string }): Promise<string | null>

  The IdP the address must sign in through: STAFF_IDENTITY_PROVIDER for CFX staff, else the active SSO connection's Cognito provider name for its domain.

  Parameters

  • input: { email: string }

  Returns Promise<string | null>

OptionalprovisionInvitee

• provisionInvitee?(input: { email: string }): Promise<boolean>

  Set where the pool is admin-create-only: gives an address with a PENDING invitation a passwordless login, true when it has one. Sign-up then sets the password by an emailed code, answering the same for any address.

  Parameters

  • input: { email: string }

  Returns Promise<boolean>

qrPngBase64

• qrPngBase64(otpauthUri: string): Promise<string>

  The otpauth URI's QR code as a base64 PNG.

  Parameters

  • otpauthUri: string

  Returns Promise<string>

recordSecondFactorRejection

• recordSecondFactorRejection(
      input: {
          cognitoSub: string;
          reason: CognitoAuthErrorCode;
          stage: "setup" | "sign-in";
      },
  ): Promise<void>

  Records an authenticator code refused at setup or at sign-in, before any session exists, so an operator can see a login stuck on it. A failure is reported, never shown: the screen answers the code either way.

  Parameters

  • input: { cognitoSub: string; reason: CognitoAuthErrorCode; stage: "setup" | "sign-in" }

    • cognitoSub: string

      The challenge's username, which is the login's sub.

    • reason: CognitoAuthErrorCode

    • stage: "setup" | "sign-in"

  Returns Promise<void>

reportError

• reportError(error: unknown): void

  A failure that isn't a refusal: the screen says "unavailable", this says why.

  Parameters

  • error: unknown

  Returns void

savePhoneNumber

• savePhoneNumber(input: { phoneNumber: string }): Promise<void>

  Stores an E.164 number on the session's user, through the user service's update.

  Parameters

  • input: { phoneNumber: string }

  Returns Promise<void>

sessionState

• sessionState(): Promise<CognitoSessionState | null>

  The current session's user, or null when there is no session.

  Returns Promise<CognitoSessionState | null>

startSession

• startSession(
      input: {
          inviteId?: string;
          method: NativeSignIn;
          timeZone?: string;
          tokens: CognitoTokens;
      },
  ): Promise<{ error: E; ok: false } | { ok: true; value: T }>

  Keeps the tokens as the app's session (its cookie) and reads the user they name. A session it refuses is the err, shown as that refusal.

  Parameters

  • input: {
        inviteId?: string;
        method: NativeSignIn;
        timeZone?: string;
        tokens: CognitoTokens;
    }

    • OptionalinviteId?: string

    • method: NativeSignIn

      Which sign-in ran, recorded with the session for its SSO checks.

    • OptionaltimeZone?: string

      The browser's zone, unvalidated: stored only on a row created now.

    • tokens: CognitoTokens

  Returns Promise<{ error: E; ok: false } | { ok: true; value: T }>