Session Management

/**
 * Represents a user session containing authentication tokens
 * @param data - Session data with tokens
 */
class CognitoUserSession {
  constructor(data: ICognitoUserSessionData);

  /** Returns the ID token */
  getIdToken(): CognitoIdToken;
  
  /** Returns the access token */
  getAccessToken(): CognitoAccessToken;
  
  /** Returns the refresh token */
  getRefreshToken(): CognitoRefreshToken;
  
  /** Checks if the session is valid (tokens not expired) */
  isValid(): boolean;
}

interface ICognitoUserSessionData {
  /** JWT ID token */
  IdToken: CognitoIdToken;
  /** JWT access token */
  AccessToken: CognitoAccessToken;
  /** JWT refresh token (optional) */
  RefreshToken?: CognitoRefreshToken;
}

/**
 * Represents a Cognito access token
 */
class CognitoAccessToken {
  payload: { [key: string]: any };
  
  constructor(params: { AccessToken: string });
  
  /** Returns the raw JWT token string */
  getJwtToken(): string;
  
  /** Returns token expiration timestamp */
  getExpiration(): number;
  
  /** Returns token issued at timestamp */
  getIssuedAt(): number;
  
  /** Decodes and returns the token payload */
  decodePayload(): { [key: string]: any };
}

/**
 * Represents a Cognito ID token
 */
class CognitoIdToken {
  payload: { [key: string]: any };
  
  constructor(params: { IdToken: string });
  
  /** Returns the raw JWT token string */
  getJwtToken(): string;
  
  /** Returns token expiration timestamp */
  getExpiration(): number;
  
  /** Returns token issued at timestamp */
  getIssuedAt(): number;
  
  /** Decodes and returns the token payload */
  decodePayload(): { [key: string]: any };
}

/**
 * Represents a Cognito refresh token
 */
class CognitoRefreshToken {
  constructor(params: { RefreshToken: string });
  
  /** Returns the refresh token string */
  getToken(): string;
}

import { CognitoUserSession, CognitoIdToken, CognitoAccessToken, CognitoRefreshToken } from "amazon-cognito-identity-js";

// Working with session after authentication
cognitoUser.authenticateUser(authDetails, {
  onSuccess: (session) => {
    // Check session validity
    if (session.isValid()) {
      console.log("Session is valid");
      
      // Get tokens
      const idToken = session.getIdToken();
      const accessToken = session.getAccessToken();
      const refreshToken = session.getRefreshToken();
      
      // Use tokens
      console.log("ID Token:", idToken.getJwtToken());
      console.log("Access Token:", accessToken.getJwtToken());
      
      // Decode token payloads
      const idPayload = idToken.decodePayload();
      const accessPayload = accessToken.decodePayload();
      
      console.log("User sub:", idPayload.sub);
      console.log("User email:", idPayload.email);
      console.log("Token expiration:", new Date(accessToken.getExpiration() * 1000));
    }
  }
});

// Manual session creation (rare case)
const session = new CognitoUserSession({
  IdToken: new CognitoIdToken({ IdToken: "eyJ..." }),
  AccessToken: new CognitoAccessToken({ AccessToken: "eyJ..." }),
  RefreshToken: new CognitoRefreshToken({ RefreshToken: "eyJ..." })
});

/**
 * Refreshes the user session using refresh token
 * @param refreshToken - Valid refresh token
 * @param callback - Callback with refreshed session result
 * @param clientMetadata - Optional client metadata for Lambda triggers
 */
refreshSession(
  refreshToken: CognitoRefreshToken,
  callback: NodeCallback<any, any>,
  clientMetadata?: ClientMetadata
): void;

// Refresh session when access token expires
const refreshToken = session.getRefreshToken();

cognitoUser.refreshSession(refreshToken, (err, session) => {
  if (err) {
    console.error("Session refresh failed:", err);
    // Redirect to login
    return;
  }
  
  console.log("Session refreshed successfully");
  // Update stored session
  cognitoUser.setSignInUserSession(session);
});

// Extract user information from tokens
const idToken = session.getIdToken();
const accessToken = session.getAccessToken();

const idPayload = idToken.decodePayload();
const accessPayload = accessToken.decodePayload();

// User information
const userId = idPayload.sub;
const username = idPayload["cognito:username"];
const email = idPayload.email;
const emailVerified = idPayload.email_verified;

// Token information
const tokenExpiration = accessToken.getExpiration();
const isExpired = Date.now() >= tokenExpiration * 1000;

console.log(`User: ${username} (${email})`);
console.log(`Email verified: ${emailVerified}`);
console.log(`Token expires: ${new Date(tokenExpiration * 1000)}`);
console.log(`Token expired: ${isExpired}`);

/**
 * Gets session from storage or refreshes if needed
 * @param callback - Callback with session result
 * @param options - Optional session options
 */
getSession(
  callback: 
    | ((error: Error, session: null) => void)
    | ((error: null, session: CognitoUserSession) => void),
  options?: GetSessionOptions
): void;

interface GetSessionOptions {
  clientMetadata: Record<string, string>;
}

// Check for existing session
cognitoUser.getSession((err, session) => {
  if (err) {
    console.error("Session error:", err);
    // Redirect to login
    return;
  }
  
  if (session) {
    console.log("Found valid session");
    // User is authenticated
    proceedWithAuthenticatedUser(session);
  } else {
    console.log("No valid session found");
    // Show login form
    showLoginForm();
  }
});

function validateSession(session: CognitoUserSession): boolean {
  if (!session) return false;
  
  // Check overall session validity
  if (!session.isValid()) return false;
  
  // Check individual token expiration
  const accessToken = session.getAccessToken();
  const idToken = session.getIdToken();
  
  const now = Date.now() / 1000;
  
  if (accessToken.getExpiration() <= now) return false;
  if (idToken.getExpiration() <= now) return false;
  
  return true;
}

cognitoUser.getSession((err, session) => {
  if (err) {
    switch (err.code) {
      case 'NotAuthorizedException':
        console.log("User not authorized, refresh token invalid");
        // Clear local session and redirect to login
        break;
      case 'NetworkError':
        console.log("Network error during session refresh");
        // Retry or show offline message
        break;
      default:
        console.error("Session error:", err);
    }
    return;
  }
  
  // Session is valid
  useValidSession(session);
});