One-time Password Authentication with the Amplify Libraries for Swift

amplify init

? Enter a name for the project OTPSwiftBlog
The following configuration will be applied:

Project information
| Name: OTPSwiftBlog
| Environment: dev
| Default editor: Visual Studio Code
| App type: ios

? Initialize the project with the above configuration? Yes
Using default provider  awscloudformation
? Select the authentication method you want to use: AWS profile
? Please choose the profile you want to use kyle-west-2
✔ Help improve Amplify CLI by sharing non sensitive configurations on failures (y/N) · no

amplify add auth

Do you want to use the default authentication and security configuration? 
   Manual configuration
Select the authentication/authorization services that you want to use: 
   User Sign-Up, Sign-In, connected with AWS IAM controls (Enables per-user Storage features for images or other content, Analytics, and more)
Provide a friendly name for your resource that will be used to label this category in the project: 
   <Hit enter to provide default value or enter a custom value>
Enter a name for your identity pool. 
   <Hit enter to provide default value or enter a custom value>
Allow unauthenticated logins? (Provides scoped down permissions that you can control via AWS IAM) 
   No
Do you want to enable 3rd party authentication providers in your identity pool? 
   No
Provide a name for your user pool: 
   <Hit enter to provide default value or enter a custom value>
How do you want users to be able to sign in? 
   Username
Do you want to add User Pool Groups? 
   No
Do you want to add an admin queries API? 
   No
Multifactor authentication (MFA) user login options: 
   OFF
Email based user registration/forgot password: 
   Enabled (Requires per-user email entry at registration)
Specify an email verification subject: 
   Your verification code
Specify an email verification message: 
   Your verification code is {####}
Do you want to override the default password policy for this User Pool? 
   No
What attributes are required for signing up? 
   Email
Specify the app's refresh token expiration period (in days): 
   30
Do you want to specify the user attributes this app can read and write? 
   No
Do you want to enable any of the following capabilities? 
   <Hit Enter without any selected>
Do you want to use an OAuth flow? 
   No
? Do you want to configure Lambda Triggers for Cognito? 
   Yes
? Which triggers do you want to enable for 
   Cognito Create Auth Challenge, Define Auth Challenge, Verify Auth Challenge Response
? What functionality do you want to use for Create Auth Challenge 
   Custom Auth Challenge Scaffolding (Creation)
? What functionality do you want to use for Define Auth Challenge 
   Custom Auth Challenge Scaffolding (Definition)
? What functionality do you want to use for Verify Auth Challenge Response 
   Custom Auth Challenge Scaffolding (Verification)
? Do you want to edit your boilerplate-create-challenge function now? 
   Yes (See snippet below)
? Do you want to edit your boilerplate-define-challenge function now? 
   Yes (See snippet below)
? Do you want to edit your boilerplate-verify function now? 
   Yes (See snippet below)

var aws = require("aws-sdk");
var ses = new aws.SES({ region: "us-west-2" }); // This is your SES region
const digitGenerator = require("crypto-secure-random-digit");

// 1
function sendChallengeCode(emailAddress, secretCode) {
  var params = {
    Destination: {
      ToAddresses: [emailAddress],
    },
    Message: {
      Body: {
        Text: { Data: secretCode },
      },
      Subject: { Data: "Email Verification Code" },
    },
    Source: "<YOUR_SES_VERIFIED_EMAIL>", // This is you SES Identity Email
  };

  return ses.sendEmail(params).promise();
}

exports.handler = async function (event) {
  if (event.request.challengeName === "CUSTOM_CHALLENGE") {
    // Generate a random code for the custom challenge
    const challengeCode = digitGenerator.randomDigits(6).join("");

    event.response.privateChallengeParameters = {};
		// 2
    event.response.privateChallengeParameters.answer = challengeCode;

		// 3
    event.response.publicChallengeParameters = {};
    event.response.publicChallengeParameters["fieldTitle"] = "Enter the secret";
    event.response.publicChallengeParameters["fieldHint"] = "Check your email";

    return sendChallengeCode(event.request.userAttributes.email, challengeCode);
  }
};

exports.handler = async function (event) {
  if (event.request.session.length == 0) {
    event.response.issueTokens = false;
    event.response.failAuthentication = false;
    event.response.challengeName = "CUSTOM_CHALLENGE";
  } else if (
    event.request.session.length == 1 &&
    event.request.session[0].challengeName == "CUSTOM_CHALLENGE" &&
    event.request.session[0].challengeResult == true
  ) {
    event.response.issueTokens = true;
    event.response.failAuthentication = false;
    event.response.challengeName = "CUSTOM_CHALLENGE";
  } else {
    event.response.issueTokens = false;
    event.response.failAuthentication = true;
  }
};

function verifyAuthChallengeResponse(event) {
  if (
    event.request.privateChallengeParameters.answer ===
    event.request.challengeAnswer
  ) {
    event.response.answerCorrect = true;
  } else {
    event.response.answerCorrect = false;
  }
}

exports.handler = async (event) => {
  verifyAuthChallengeResponse(event);
};

[
  {
    "Effect": "Allow",
    "Action": [
      "ses:SendEmail",
      "ses:SendRawEmail"
    ],
    "Resource": ["*"]
  }
]

{
  "name": "otpswiftblog00d2416400d24164CreateAuthChallenge",
  "version": "2.0.0",
  "description": "Lambda function generated by Amplify",
  "main": "index.js",
  "license": "Apache-2.0",
  "dependencies": { // <- Add
    "crypto-secure-random-digit": "^1.0.9" // <- Add
  }, // <- Add
  "devDependencies": {
    "@types/aws-lambda": "^8.10.92"
  }
}

amplify push

│ Category │ Resource name                             │ Operation │ Provider plugin   │
├──────────┼───────────────────────────────────────────┼───────────┼───────────────────┤
│ Function │ <YOUR_PROJECT>CreateAuthChallenge         │ Create    │ awscloudformation │
├──────────┼───────────────────────────────────────────┼───────────┼───────────────────┤
│ Function │ <YOUR_PROJECT>DefineAuthChallenge         │ Create    │ awscloudformation │
├──────────┼───────────────────────────────────────────┼───────────┼───────────────────┤
│ Function │ <YOUR_PROJECT>VerifyAuthChallengeResponse │ Create    │ awscloudformation │
├──────────┼───────────────────────────────────────────┼───────────┼───────────────────┤
│ Auth     │ <YOUR_PROJECT>                            │ Create    │ awscloudformation │

Deployment completed.

import Amplify
import AWSCognitoAuthPlugin

func configureAmplify() {
    do {
        try Amplify.add(plugin: AWSCognitoAuthPlugin())
        try Amplify.configure()
        print("Successfully configured Amplify")
    } catch {
        print("Failed to initialize Amplify:", error)
    }
}

init() {
    configureAmplify()
}

Successfully configured Amplify

import Amplify

func signUp() {
    Task {
        do {
            let options = AuthSignUpRequest.Options(
                userAttributes: [.init(.email, value: email)]
            )
            let result = try await Amplify.Auth.signUp(
                username: username,
                password: UUID().uuidString, // <- Random password
                options: options
            )
            switch result.nextStep {
            case .confirmUser:
                print("Next step is to confirm user")
                confirmSignUpIsVisible = true
            case .done:
                print("Sign up is finished")
            }
        } catch {
            print("Sign up failed", error)
        }
    }
}

Button("Sign Up", action: signUp)

import Amplify

func confirmSignUp() {
    Task {
        do {
            let result = try await Amplify.Auth.confirmSignUp(
                for: username,
                confirmationCode: verificationCode
            )
            switch result.nextStep {
            case .confirmUser:
                print("Unexpected next step")
            case .done:
                print("Sign up finished")
                didConfirmSignUp()
            }
        } catch {
            print("Failed to confirm sign up", error)
        }
    }
}

Button("Confirm Sign Up", action: confirmSignUp)

import Amplify
import AWSCognitoAuthPlugin

func login() {
    Task {
        do {
						// 1
            let options = AWSAuthSignInOptions(authFlowType: .customWithoutSRP)
            let result = try await Amplify.Auth.signIn(
                username: username,
                options: .init(pluginOptions: options)
            )
            switch result.nextStep {
						// 2
            case .confirmSignInWithCustomChallenge(let info):
                print("User must enter custom challenge. Additonal info: ", info ?? "N/A")
                emailCodeIsVisible = true
            default:
                print("Unexpected auth flow. Next step:", result.nextStep)
            }
        } catch {
            print("Failed to login", error)
        }
    }
}

Button("Login", action: login)

import Amplify

func confirmSignIn() {
    Task {
        do {
            let result = try await Amplify.Auth.confirmSignIn(challengeResponse: emailCode)
            switch result.nextStep {
            case .done:
                print("User has successfully signed in")
                didConfirmLogin()
            default:
                print("Unexpected step:", result.nextStep)
            }
        } catch {
            print("Confirm sign in failed:", error)
        }
    }
}

Button("Confirm Login", action: confirmSignIn)