fix(auth): update token provider auth config on reconfigure

When Amplify.configure() is called multiple times (e.g. to switch
userPoolClientId for multi-tenant apps), the cognitoUserPoolsTokenProvider
was not updated with the new auth config. This caused token refresh to
use the stale userPoolClientId, failing with NotAuthorizedException.

The fix adds cognitoUserPoolsTokenProvider.setAuthConfig() calls to the
two reconfigure code paths that were missing them in initSingleton.ts.

Closes #14620

Author: anivar

.changeset/fix-stale-auth-config-reconfigure.md

@@ -0,0 +1,9 @@
+---
+'aws-amplify': patch
+---
+
+fix(auth): update token provider auth config on reconfigure
+
+When `Amplify.configure()` is called multiple times to switch `userPoolClientId`,
+the token provider now receives the updated auth config, ensuring token refresh
+uses the correct client ID.

packages/aws-amplify/__tests__/initSingleton.test.ts

@@ -328,7 +328,7 @@ describe('initSingleton (DefaultAmplify)', () => {
 
 					expect(
 						mockCognitoUserPoolsTokenProviderSetAuthConfig,
-					).not.toHaveBeenCalled();
+					).toHaveBeenCalledWith(mockResourceConfig.Auth);
 					expect(MockCookieStorage).toHaveBeenCalledWith({ sameSite: 'lax' });
 					expect(
 						mockCognitoUserPoolsTokenProviderSetKeyValueStorage,
@@ -348,7 +348,7 @@ describe('initSingleton (DefaultAmplify)', () => {
 
 					expect(
 						mockCognitoUserPoolsTokenProviderSetAuthConfig,
-					).not.toHaveBeenCalled();
+					).toHaveBeenCalledWith(mockResourceConfig.Auth);
 					expect(
 						mockCognitoUserPoolsTokenProviderSetKeyValueStorage,
 					).toHaveBeenCalledWith(defaultStorage);
@@ -369,7 +369,7 @@ describe('initSingleton (DefaultAmplify)', () => {
 
 					expect(
 						mockCognitoUserPoolsTokenProviderSetAuthConfig,
-					).not.toHaveBeenCalled();
+					).toHaveBeenCalledWith(mockResourceConfig.Auth);
 					expect(
 						mockCognitoUserPoolsTokenProviderSetKeyValueStorage,
 					).not.toHaveBeenCalled();
@@ -382,13 +382,39 @@ describe('initSingleton (DefaultAmplify)', () => {
 					);
 				});
 
-				it('should just configure without touching libraryOptions', () => {
+				it('should update auth config and configure without touching libraryOptions', () => {
 					Amplify.configure(mockResourceConfig);
 
+					expect(
+						mockCognitoUserPoolsTokenProviderSetAuthConfig,
+					).toHaveBeenCalledWith(mockResourceConfig.Auth);
 					expect(mockAmplifySingletonConfigure).toHaveBeenCalledWith(
 						mockResourceConfig,
 					);
 				});
+
+				it('should update token provider auth config when userPoolClientId changes on reconfigure', () => {
+					// First configure
+					Amplify.configure(mockResourceConfig);
+
+					mockCognitoUserPoolsTokenProviderSetAuthConfig.mockClear();
+
+					// Reconfigure with different userPoolClientId
+					const newConfig: ResourcesConfig = {
+						...mockResourceConfig,
+						Auth: {
+							Cognito: {
+								userPoolClientId: 'newUserPoolClientId',
+								userPoolId: 'userPoolId',
+							},
+						},
+					};
+					Amplify.configure(newConfig);
+
+					expect(
+						mockCognitoUserPoolsTokenProviderSetAuthConfig,
+					).toHaveBeenCalledWith(newConfig.Auth);
+				});
 			});
 
 			it('should invoke AmplifySingleton.configure with other provided library options', () => {

packages/aws-amplify/src/initSingleton.ts

@@ -97,6 +97,8 @@ export const DefaultAmplify = {
 				authLibraryOptions.credentialsProvider = resolvedCredentialsProvider;
 			}
 
+			cognitoUserPoolsTokenProvider.setAuthConfig(resolvedResourceConfig.Auth);
+
 			Amplify.configure(resolvedResourceConfig, {
 				Auth: authLibraryOptions,
 				...libraryOptions,
@@ -107,6 +109,7 @@ export const DefaultAmplify = {
 
 		// Finally, if there were no libraryOptions given at all, we should simply not touch the currently
 		// configured libraryOptions.
+		cognitoUserPoolsTokenProvider.setAuthConfig(resolvedResourceConfig.Auth);
 		Amplify.configure(resolvedResourceConfig);
 	},
 	/**