Merge branch 'main' into feature/12820/crossTab-signIn-signOut

Author: bobbor

.github/CODEOWNERS

@@ -15,24 +15,24 @@
 
 # The following paths involve server-side use cases, token/user session management.
 # Changes made to these paths requires additional reviews and approvals.
-/packages/auth @pranavosu @sobolk @Amplifiyer @avi-karthik 
-/packages/aws-amplify/src/adapter-core @pranavosu @sobolk @Amplifiyer @avi-karthik 
-/packages/core/src/adapterCore @pranavosu @sobolk @Amplifiyer @avi-karthik 
-/packages/core/src/singleton @pranavosu @sobolk @Amplifiyer @avi-karthik 
-/packages/core/src/utils/convert @pranavosu @sobolk @Amplifiyer @avi-karthik 
-/packages/core/src/utils/WordArray.ts @pranavosu @sobolk @Amplifiyer @avi-karthik 
-/packages/core/src/storage @pranavosu @sobolk @Amplifiyer @avi-karthik 
-/packages/core/src/utils/generateRandomString.ts @pranavosu @sobolk @Amplifiyer @avi-karthik 
-/packages/core/src/utils/globalHelpers @pranavosu @sobolk @Amplifiyer @avi-karthik 
-/packages/core/src/utils/urlSafeDecode.ts @pranavosu @sobolk @Amplifiyer @avi-karthik 
-/packages/core/src/awsClients/cognitoIdentity @pranavosu @sobolk @Amplifiyer @avi-karthik 
-/packages/core/src/clients/internal @pranavosu @sobolk @Amplifiyer @avi-karthik 
-/packages/core/src/Hub @pranavosu @sobolk @Amplifiyer @avi-karthik 
-/packages/adapter-nextjs @pranavosu @sobolk @Amplifiyer @avi-karthik 
-/packages/rtn-web-browser @pranavosu @sobolk @Amplifiyer @avi-karthik 
-/packages/storage/src/providers/s3/apis/internal @pranavosu @sobolk @Amplifiyer @avi-karthik 
-/packages/storage/src/providers/s3/apis/server @pranavosu @sobolk @Amplifiyer @avi-karthik 
-/packages/api-rest/src/apis/server.ts @pranavosu @sobolk @Amplifiyer @avi-karthik 
-/packages/api-rest/src/apis/common/internalPost.ts @pranavosu @sobolk @Amplifiyer @avi-karthik 
-/packages/api-graphql/src/server @pranavosu @sobolk @Amplifiyer @avi-karthik 
-/packages/api-graphql/src/internals/server @pranavosu @sobolk @Amplifiyer @avi-karthik 
+/packages/auth @pranavosu @sarayev @avi-karthik 
+/packages/aws-amplify/src/adapter-core @pranavosu @sarayev @avi-karthik 
+/packages/core/src/adapterCore @pranavosu @sarayev @avi-karthik 
+/packages/core/src/singleton @pranavosu @sarayev @avi-karthik 
+/packages/core/src/utils/convert @pranavosu @sarayev @avi-karthik 
+/packages/core/src/utils/WordArray.ts @pranavosu @sarayev @avi-karthik 
+/packages/core/src/storage @pranavosu @sarayev @avi-karthik 
+/packages/core/src/utils/generateRandomString.ts @pranavosu @sarayev @avi-karthik 
+/packages/core/src/utils/globalHelpers @pranavosu @sarayev @avi-karthik 
+/packages/core/src/utils/urlSafeDecode.ts @pranavosu @sarayev @avi-karthik 
+/packages/core/src/awsClients/cognitoIdentity @pranavosu @sarayev @avi-karthik 
+/packages/core/src/clients/internal @pranavosu @sarayev @avi-karthik 
+/packages/core/src/Hub @pranavosu @sarayev @avi-karthik 
+/packages/adapter-nextjs @pranavosu @sarayev @avi-karthik 
+/packages/rtn-web-browser @pranavosu @sarayev @avi-karthik 
+/packages/storage/src/providers/s3/apis/internal @pranavosu @sarayev @avi-karthik 
+/packages/storage/src/providers/s3/apis/server @pranavosu @sarayev @avi-karthik 
+/packages/api-rest/src/apis/server.ts @pranavosu @sarayev @avi-karthik 
+/packages/api-rest/src/apis/common/internalPost.ts @pranavosu @sarayev @avi-karthik 
+/packages/api-graphql/src/server @pranavosu @sarayev @avi-karthik 
+/packages/api-graphql/src/internals/server @pranavosu @sarayev @avi-karthik 

.github/actions/node-and-build/action.yml

@@ -7,10 +7,10 @@ inputs:
 runs:
   using: 'composite'
   steps:
-    - name: Setup Node.js 20
-      uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
+    - name: Setup Node.js 22
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
-        node-version: 20
+        node-version: 22
       env:
         SEGMENT_DOWNLOAD_TIMEOUT_MINS: 2
     - uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
@@ -33,9 +33,15 @@ runs:
     # TODO We should be able to skip yarn / bootstrap if we cache enough things. Leaving because skipping causes issues.
     - name: Install
       if: inputs.is-prebuild != 'true' || steps.cache-build-artifacts.outputs.cache-hit != 'true'
-      run: yarn
       shell: bash
       working-directory: ./amplify-js
+      run: |
+        for i in {1..3}; do
+          echo "Starting attempt $i."
+          yarn && break
+          echo "Attempt $i failed."
+          sleep 5
+        done
     - name: Bootstrap
       if: inputs.is-prebuild != 'true' || steps.cache-build-artifacts.outputs.cache-hit != 'true'
       run: yarn bootstrap

.github/actions/set-status/action.yml

@@ -0,0 +1,93 @@
+name: 'Set Status'
+description: 'Set status on a specified head-sha'
+inputs:
+  context:
+    description: 'Name of the status'
+    required: true
+  description:
+    description: 'Short description of the status'
+    required: false
+  state:
+    description: >-
+      State of the status with possible values of 'error', 'failure', 'pending', 'success'
+    required: true
+  sha:
+    description: 'The commit ID to add the status to'
+    required: true
+  target-url:
+    description: >-
+      Target URL to associate with this status.
+      This URL will be linked from the GitHub UI to allow users to easily see the source of the status.'
+    required: false
+runs:
+  using: 'composite'
+  steps:
+    - name: Set a commit status
+      id: set-status
+      uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 https://github.com/actions/github-script/commit/60a0d83039c74a4aee543508d2ffcb1c3799cdea
+      env:
+        status_context: ${{ inputs.context }}
+        description: ${{ inputs.description }}
+        state: ${{ inputs.state }}
+        sha: ${{ inputs.sha }}
+        target_url: ${{ inputs.target-url }}
+        owner: ${{ github.event.repository.owner.login }}
+        repo: ${{ github.event.repository.name }}
+      with:
+        result-encoding: string
+        script: |
+          const { status_context, description, state, sha, target_url, owner, repo } = process.env;
+          const inputValidationErrors = [];
+          if (!state || state.length === 0) {
+            inputValidationErrors.push('"state" input cannot be empty.');
+          }
+          if (!["error", "failure", "pending", "success"].includes(state)) {
+            inputValidationErrors.push('"state" must be a string input with possible value of "error", "failure", "pending", "success".');
+          }
+          if (!status_context || status_context.length === 0) {
+            inputValidationErrors.push('"context" input cannot be empty.');
+          }
+          if (!sha || sha.length === 0) {
+            inputValidationErrors.push('"sha" input cannot be empty.');
+          }
+          if (!sha.match(/^[0-9a-z]+$/)) {
+            inputValidationErrors.push('"sha" must be an alphanumeric string.');
+          }
+          if (target_url && target_url.length > 0) {
+            if (target_url.length > 2048) {
+              inputValidationErrors.push('"target-url" must be less than 2048 characters.');
+            }
+
+            try {
+              const url = new URL(target_url);
+
+              if (url.protocol !== 'https:') {
+                inputValidationErrors.push('"target-url" must use HTTPS protocol.');
+              }
+
+              const allowedHostnames = ['github.com', 'api.github.com'];
+              if (!allowedHostnames.includes(url.hostname)) {
+                inputValidationErrors.push(`"target-url" must be one of: ${allowedHostnames.join(', ')}.`);
+              }
+
+            } catch (error) {
+              if (error instanceof TypeError && error.message.includes('Invalid URL')) {
+                inputValidationErrors.push('"target-url" must be a valid URL format.');
+              } else {
+                inputValidationErrors.push(`"target-url" validation failed: ${error.message}`);
+              }
+            }
+          }
+          if (inputValidationErrors.length > 0) {
+            inputValidationErrors.forEach(core.error);
+            process.exit(1);
+          }
+          github.rest.repos.createCommitStatus({
+            owner,
+            repo,
+            sha,
+            state,
+            context: status_context,
+            description: description && description.length > 0 ? description : undefined,
+            target_url: target_url && target_url.length > 0 ? target_url : undefined,
+          });

.github/actions/setup-samples-staging/action.yml

@@ -45,7 +45,12 @@ runs:
         fi
 
     - name: Install
-      run: |
-        yarn
       shell: bash
       working-directory: ./amplify-js-samples-staging
+      run: |
+        for i in {1..3}; do
+          echo "Starting attempt $i."
+          yarn && break
+          echo "Attempt $i failed."
+          sleep 5
+        done

.github/dependency-review/dependency-review-config.yml

@@ -15,6 +15,7 @@ allow-licenses:
   - 'ISC'
   - 'JSON'
   - 'MIT'
+  - 'MIT-0'
   - 'OpenSSL'
   - 'PDDL-1.0'
   - 'PostgreSQL'

.github/integ-config/detox-integ-all.yml

@@ -20,3 +20,6 @@
   working_directory: amplify-js-samples-staging/samples/react-native/auth/HosteduiApp
   timeout_minutes: 120
   host_signout_page: true
+- test_name: 'integ_rn_ios_passkeys'
+  working_directory: amplify-js-samples-staging/samples/react-native/auth/Passkeys
+  timeout_minutes: 120

.github/integ-config/integ-all-headless.yml

@@ -1,7 +1,2 @@
 tests:
   []
-  # integ_auth_test_cypress_no_ui
-  # - test_name: 'Token revocation'
-  #   category: 'auth'
-  #   spec: 'token-revocation'
-  #   is_headless: true

.github/integ-config/integ-all.yml

@@ -528,6 +528,13 @@ tests:
     sample_name: [sign-in-with-oauth]
     spec: sign-out-oidc-provider
     browser: [chrome]
+  - test_name: integ_next_auth_token_revocation
+    desc: 'Token Revocation'
+    framework: next
+    category: auth
+    sample_name: [auth-rsc]
+    spec: token-revocation
+    browser: [chrome]
 
   # AUTH GEN2
   - test_name: integ_react_javascript_authentication_gen2
@@ -622,13 +629,15 @@ tests:
     category: auth
     sample_name: [custom-auth]
     spec: custom-auth
+    retry_count: 15
     browser: *minimal_browser_list
   - test_name: integ_next_auth_sign_in_with_sms_mfa
     desc: 'Resumable sign in with SMS MFA flow'
     framework: next
     category: auth
     sample_name: [mfa]
     spec: sign-in-resumable-mfa
+    retry_count: 15
     browser: *minimal_browser_list
     env:
       NEXT_PUBLIC_BACKEND_CONFIG: resum-signin
@@ -837,20 +846,23 @@ tests:
     category: storage
     sample_name: [storage-gen2]
     spec: storage-gen2
+    retry_count: 10
     browser: *minimal_browser_list
   - test_name: integ_react_storage_internal
     desc: 'React Storage Gen2 Internal APIs'
     framework: react
     category: storage
     sample_name: [storage-gen2-internal]
     spec: storage-gen2-internal
+    retry_count: 10
     browser: *minimal_browser_list
   - test_name: integ_next_storage
     desc: 'Next Storage Auth'
     framework: next
     category: storage
     sample_name: [storage-auth]
     spec: storage-client-server
+    retry_count: 10
     browser: [chrome] # firefox issues with secure cookies in cypress, manual testing works fine
 
   # INAPPMESSAGING
@@ -913,6 +925,7 @@ tests:
     category: auth
     sample_name: [mfa]
     spec: mfa-req-email
+    retry_count: 15
     browser: *minimal_browser_list
     env:
       NEXT_PUBLIC_BACKEND_CONFIG: mfa-req-email
@@ -922,6 +935,7 @@ tests:
     category: auth
     sample_name: [mfa]
     spec: mfa-req-phone
+    retry_count: 15
     browser: *minimal_browser_list
     env:
       NEXT_PUBLIC_BACKEND_CONFIG: mfa-req-phone
@@ -931,6 +945,7 @@ tests:
     category: auth
     sample_name: [mfa]
     spec: mfa-opt-email
+    retry_count: 15
     browser: *minimal_browser_list
     env:
       NEXT_PUBLIC_BACKEND_CONFIG: mfa-opt-email
@@ -940,6 +955,7 @@ tests:
     category: auth
     sample_name: [mfa]
     spec: mfa-opt-phone
+    retry_count: 15
     browser: *minimal_browser_list
     env:
       NEXT_PUBLIC_BACKEND_CONFIG: mfa-opt-phone
@@ -949,6 +965,7 @@ tests:
     category: auth
     sample_name: [mfa]
     spec: mfa-setup
+    retry_count: 15
     browser: *minimal_browser_list
     env:
       NEXT_PUBLIC_BACKEND_CONFIG: mfa-setup
@@ -958,6 +975,7 @@ tests:
     category: auth
     sample_name: [mfa]
     spec: passwordless/auto-sign-in
+    retry_count: 15
     browser: *minimal_browser_list
     env:
       NEXT_PUBLIC_BACKEND_CONFIG: pwl-autosignin
@@ -985,6 +1003,7 @@ tests:
     category: auth
     sample_name: [mfa]
     spec: passwordless/sign-up
+    retry_count: 15
     browser: *minimal_browser_list
     env:
       NEXT_PUBLIC_BACKEND_CONFIG: pwl-signup
@@ -994,6 +1013,7 @@ tests:
     category: auth
     sample_name: [mfa]
     spec: passwordless/miscellaneous
+    retry_count: 15
     browser: *minimal_browser_list
     env:
       NEXT_PUBLIC_BACKEND_CONFIG: pwl-misc
@@ -1014,6 +1034,8 @@ tests:
     category: auth
     sample_name: [mfa]
     spec: refresh-token-auth
+    retry_count: 15
+    timeout_minutes: 90
     browser: *minimal_browser_list
     env:
       NEXT_PUBLIC_BACKEND_CONFIG: misc-tokenref

.github/workflows/callable-e2e-test-detox.yml

@@ -31,6 +31,14 @@ jobs:
           path: amplify-js
       - name: Setup node and build the repository
         uses: ./amplify-js/.github/actions/node-and-build
+      - name: Set Xcode version
+        run: |
+          sudo xcode-select -s /Applications/Xcode_16.4.app
+      - name: Download iOS platform and create simulator
+        if: ${{ contains(inputs.test_name, 'integ_rn_ios_passkeys') }}
+        run: |
+          xcodebuild -downloadPlatform iOS -buildVersion 17.4
+          xcrun simctl create "iPhone 15" "com.apple.CoreSimulator.SimDeviceType.iPhone-15" "com.apple.CoreSimulator.SimRuntime.iOS-17-4"
       - name: Setup samples staging repository
         uses: ./amplify-js/.github/actions/setup-samples-staging
         with:

.github/workflows/callable-get-package-list.yml

@@ -6,6 +6,9 @@ on:
       packages:
         description: The json encoded package list
         value: ${{ jobs.get-package-list.outputs.packages }}
+      nativePackages:
+        description: The json encoded native package list
+        value: ${{ jobs.get-package-list.outputs.nativePackages }}
 jobs:
   get-package-list:
     name: Get packages list
@@ -31,11 +34,14 @@ jobs:
       - name: Dump Package List
         if: steps.cache-package-list.outputs.cache-hit != 'true'
         run: |
-          echo "packages=$(yarn lerna ll | egrep -v "lerna|Done|yarn" | jq -R -s -c 'split("\n")[:-1] | map({name: split(" ")[0], path: split(" ")[-1]})')" > package-list.json
+          yarn lerna ll | egrep -v "lerna|Done|yarn" | jq -R -s -c 'split("\n")[:-1] | map({name: split(" ")[0], path: split(" ")[-1]})' > package-list.json
       - name: Get Package List
         id: get_package_list
         run: |
-          cat package-list.json >> $GITHUB_OUTPUT
-          cat package-list.json
+          echo "packages=$(cat package-list.json)" >> $GITHUB_OUTPUT
+          # temporarily filter to only packages with runnable tests
+          echo "nativePackages=$(jq -c 'map(select(.name | test("rtn-passkeys|react-native")))' package-list.json)" >> $GITHUB_OUTPUT
     outputs:
       packages: ${{ steps.get_package_list.outputs.packages }}
+      # todo: expand native package list as other tests are made runnable
+      nativePackages: ${{ steps.get_package_list.outputs.nativePackages }}