UserPoolAuth

Source: src/AWS/Cognito/UserPoolAuth.ts

Runtime binding for the public (client-side) Cognito user pool auth flows.

Bind this to a UserPoolClient inside a function runtime to get a typed client for sign-up, sign-in, and token flows. These operations are unauthenticated (Cognito does not evaluate IAM for them), so the binding grants no IAM policy — it injects the app client ID into every call.

Authenticating Users

Username/Password Sign-In

const auth = yield* Cognito.UserPoolAuth(client);

const result = yield* auth.initiateAuth({
  AuthFlow: "USER_PASSWORD_AUTH",
  AuthParameters: { USERNAME: username, PASSWORD: password },
});
const idToken = result.AuthenticationResult?.IdToken;

Sign-Up and Confirmation

yield* auth.signUp({
  Username: "user@example.com",
  Password: "Sup3r-secret!",
  UserAttributes: [{ Name: "email", Value: "user@example.com" }],
});
yield* auth.confirmSignUp({
  Username: "user@example.com",
  ConfirmationCode: code,
});

Read the Signed-In User

const user = yield* auth.getUser({ AccessToken: accessToken });

Self-Service Account Management

Change Password and Update Attributes

yield* auth.changePassword({
  AccessToken: accessToken,
  PreviousPassword: oldPassword,
  ProposedPassword: newPassword,
});
yield* auth.updateUserAttributes({
  AccessToken: accessToken,
  UserAttributes: [{ Name: "nickname", Value: "sam" }],
});

Refresh Tokens

const refreshed = yield* auth.getTokensFromRefreshToken({
  RefreshToken: refreshToken,
});